Microsoft Office RCE Wave: Two Dozen Code Execution Flaws Patched — Defender's Detection and Remediation Guide

---
title: Office Application Spawning Shell or Script Interpreter
id: 3f8a2c14-9b7d-4e61-a2c8-5d4e6f7a8b9c
status: experimental
description: Detects Microsoft Office applications spawning command shells, script interpreters, or LOLBins — a hallmark of successful malicious document exploitation via Office RCE vulnerabilities.
references:
  - https://www.securityweek.com/microsoft-patches-two-dozen-rce-flaws-in-office/
  - https://attack.mitre.org/techniques/T1203/
  - https://attack.mitre.org/techniques/T1566/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\POWERPNT.EXE'
      - '\OUTLOOK.EXE'
      - '\MSPUB.EXE'
      - '\VISIO.EXE'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\msbuild.exe'
      - '\curl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate add-ins that invoke system utilities (tune per environment)
  - Microsoft Office troubleshooting/telemetry tools during support sessions
level: high
---
title: Office Process Writing Executable Content to User-Writable Directories
id: 8c1d4e72-3a5b-4f96-b7d2-9e8f1a2c3d4e
status: experimental
description: Detects Office applications dropping executable files or scripts to user-writable locations such as AppData, Temp, or Downloads — consistent with payload staging after document exploitation.
references:
  - https://www.securityweek.com/microsoft-patches-two-dozen-rce-flaws-in-office/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\POWERPNT.EXE'
      - '\OUTLOOK.EXE'
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Downloads\'
      - '\ProgramData\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.bat'
      - '.vbs'
      - '.js'
      - '.hta'
      - '.scr'
      - '.lnk'
  condition: selection_image and selection_path and selection_ext
falsepositives:
  - Office template or add-in updates (limited paths/extensions — tune allowlist)
level: high

// Hunt: Office processes spawning shells, script interpreters, or LOLBins
// Run in Microsoft Sentinel / Defender XDR — lookback tuned to post-patch-diff window
let lookback = 14d;
let officeProcs = dynamic(["WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "OUTLOOK.EXE", "MSPUB.EXE", "VISIO.EXE"]);
let suspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "certutil.exe", "bitsadmin.exe", "curl.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName in~ (officeProcs)
| where FileName in~ (suspiciousChildren)
| project TimeGenerated, DeviceName, AccountName,
    InitiatingProcessFileName, InitiatingProcessCommandLine,
    FileName, ProcessCommandLine, SHA256, ReportId
| order by TimeGenerated desc

// Companion hunt: Office processes establishing outbound network connections
// to uncommon external IPs (payload retrieval / C2 after document open)
let officeProcs2 = dynamic(["WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE"]);
DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName in~ (officeProcs2)
| where RemoteIPType == "Public"
| where RemotePort in (80, 443, 8080, 8443)
| summarize Connections = count(), Ports = make_set(RemotePort) by DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl
| where Connections < 5  // low-volume, beacon-like behavior
| order by Connections asc

-- Hunt: Office applications with suspicious child processes or outbound connections
-- Deploy as a Velociraptor hunt across the fleet to triage potentially exploited endpoints

-- Stage 1: Office processes and their full command lines
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)winword|excel|powerpnt|outlook'

-- Stage 2: Children of Office PIDs (run after collecting Office PIDs, or correlate client-side)
SELECT Pid, Ppid, Name, CommandLine, Username
FROM pslist()
WHERE Name =~ '(?i)cmd|powershell|pwsh|mshta|wscript|cscript|rundll32|regsvr32|certutil'

-- Stage 3: Network connections held by Office processes (payload fetch / C2)
SELECT Pid, Name, Status, Laddr, Lport, Raddr, Rport
FROM netstat()
WHERE Name =~ '(?i)winword|excel|powerpnt'
  AND Status =~ 'ESTABLISHED'

# Office Patch Verification & Hardening Script
# Run elevated. Verifies Office build currency and applies defense-in-depth controls.

# --- 1. Inventory installed Office version ---
$officeKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration',
    'HKLM:\SOFTWARE\Microsoft\Office\16.0\Word\InstallRoot'
)
foreach ($key in $officeKeys) {
    if (Test-Path $key) {
        Get-ItemProperty -Path $key | Select-Object ProductReleaseIds, VersionToReport, Platform -ErrorAction SilentlyContinue
    }
}
Write-Host "[*] Compare the reported build against the latest patched build in the Microsoft Security Update Guide: https://msrc.microsoft.com/update-guide" -ForegroundColor Cyan

# --- 2. Force Microsoft 365 Apps update check (Click-to-Run) ---
$c2r = "$env:ProgramFiles\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe"
if (Test-Path $c2r) {
    Write-Host "[*] Triggering Click-to-Run update..." -ForegroundColor Cyan
    Start-Process $c2r -ArgumentList '/update user displaylevel=false forceappshutdown=true' -Wait
} else {
    Write-Host "[!] Click-to-Run client not found — MSI install? Deploy KBs via WSUS/Intune." -ForegroundColor Yellow
}

# --- 3. Defense-in-depth: block Office child processes via Attack Surface Reduction rule ---
# ASR rule: Block all Office applications from creating child processes
# GUID: d4f940ab-401b-4efc-aadc-ad5f3c50688a
Write-Host "[*] Enabling ASR rule: Office child process creation (block mode)..." -ForegroundColor Cyan
Add-MpPreference -AttackSurfaceReductionRules_Ids 'd4f940ab-401b-4efc-aadc-ad5f3c50688a' -AttackSurfaceReductionRules_Actions Enabled

# ASR rule: Block Office applications from creating executable content
# GUID: 3b576869-a4ec-4529-8536-b80a7769e899
Add-MpPreference -AttackSurfaceReductionRules_Ids '3b576869-a4ec-4529-8536-b80a7769e899' -AttackSurfaceReductionRules_Actions Enabled

# ASR rule: Block Office applications from injecting code into other processes
# GUID: 75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84
Add-MpPreference -AttackSurfaceReductionRules_Ids '75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84' -AttackSurfaceReductionRules_Actions Enabled

# --- 4. Verify ASR state ---
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Write-Host "[*] Confirm action states: 0=Off, 1=Block, 2=Audit, 6=Warn" -ForegroundColor Cyan
(Get-MpPreference).AttackSurfaceReductionRules_Actions

# --- 5. Audit logging baseline: ensure process creation + command line logging is on ---
auditpol /set /subcategory:"Process Creation" /success:enable
$cmdline = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit'
if (-not (Test-Path $cmdline)) { New-Item -Path $cmdline -Force | Out-Null }
Set-ItemProperty -Path $cmdline -Name 'ProcessCreationIncludeCmdLine_Enabled' -Value 1
Write-Host "[+] Audit policy configured. Review ASR events: Event ID 1121 (block) / 1122 (audit) in Microsoft-Windows-Windows Defender/Operational." -ForegroundColor Green