[[ fm.text ]] Click here

Office application spawning LOLBin (CVE-2025-62554)

SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Apache-2.0

Detects Office apps spawning LOLBins or script engines. BROAD hunting rule for CVE-2025-62554 post-exploitation chains; expect add-in noise.

title: Office application spawning LOLBin (CVE-2025-62554)
id: 941ab46d-16b6-44b3-8586-5386f6c8d465
status: experimental
description: |
  Detects Office apps spawning LOLBins or script engines. BROAD hunting rule for CVE-2025-62554 post-exploitation chains; expect add-in noise. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
  Détecte des applications Microsoft Office lançant des LOLBins communs ou des moteurs de script. Règle BROAD pour le hunting et le triage des chaînes d'exploitation client-side, incluant CVE-2025-62554 (type confusion Office). Ne détecte pas l'exploit lui-même mais les comportements post-exécution. Bruit attendu depuis les add-ins ; tuner par signataire ou pattern de commande parent. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
related:
  - id: ba8c4cb7-ae85-4bf3-9b51-73ed8f0918dc
    type: similar

author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2025-12-22
modified: 2026-06-19
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-62554
  - https://www.thezdi.com/blog/2025/12/9/the-december-2025-security-update-review

tags:
  - attack.initial-access
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001
  - attack.t1218
  - cve.2025-62554

logsource:
  product: windows
  category: process_creation

detection:
  selection_office_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\onenote.exe'
      - '\mspub.exe'

  selection_lolbin_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\schtasks.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
      - '\msiexec.exe'
      - '\curl.exe'
      - '\forfiles.exe'
      - '\pcalua.exe'
      - '\odbcconf.exe'
      - '\wmic.exe'

  # Standard COM/OLE invocation modes used by legitimate integrations
  filter_main_office_automation:
    ParentCommandLine|contains:
      - '/automation'
      - '/pt '
      - '/embedding'

  condition: selection_office_parent and selection_lolbin_child and not filter_main_office_automation

fields:
  - UtcTime
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
  - User
  - IntegrityLevel
  - ProcessId
  - ParentProcessId

falsepositives:
  - Legitimate Office add-ins and automation (VBA/COM) launching scripts or installers
  - Software deployment or enterprise automation triggered by Office templates

level: medium

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

4df62962-f7a4-4008-b4f9-449462e70417

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion