Suspicious Microsoft Office Child Process — Detection Rule

Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)

Read the full analysis on IntelFusions