[[ fm.text ]] Click here

Microsoft Office child process with exploitation indicators (CVE-2026-20957)

SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Apache-2.0

Detects suspicious child processes from Office apps, targeting post-exploitation behaviors from CVE-2026-20957 Excel integer underflow RCE.

title: Microsoft Office child process with exploitation indicators (CVE-2026-20957)
id: c36280ec-bbdd-4e2a-9a60-19c20eec2590
status: experimental
description: |
  Detects suspicious child processes from Office apps, targeting post-exploitation behaviors from CVE-2026-20957 Excel integer underflow RCE. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
  Détecte l'exécution de processus enfants suspects par la suite Microsoft Office. Cible spécifiquement les comportements post-exploitation de CVE-2026-20957 (RCE via integer underflow Excel). Niveau critical justifié par la combinaison parent Office + LOLBin + indicateurs CLI d'obfuscation/download. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
related:
  - id: 0a8e2b74-5d1e-4b1c-bc6e-81a42a3f0b91
    type: similar

author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-01-18
modified: 2026-06-19
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-20957
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20957
  - https://www.cve.org/CVERecord?id=CVE-2026-20957
tags:
  - attack.execution
  - attack.t1059.001
  - cve.2026-20957
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\msaccess.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  selection_suspicious_args:
    CommandLine|contains:
      # NOTE: '.dll' and ' bypass ' alone removed, near-universal FP
      # (almost every Windows CLI passes DLL paths, and 'bypass' appears in legitimate PS help text)
      - ' -enc '
      - ' -EncodedCommand '
      - ' -ExecutionPolicy Bypass'
      - ' -ExecutionPolicy bypass'
      - 'FromBase64String'
      - 'Invoke-Expression'
      - 'IEX'
      - 'DownloadString'
      - 'Invoke-WebRequest'
      - ' iwr '
      - 'http://'
      - 'https://'
  # Filter legitimate Office automation invocation modes
  filter_main_office_automation:
    ParentCommandLine|contains:
      - '/automation'
      - '/pt '
      - '/embedding'

  # Filter known signed Office update binaries spawning from official Office paths
  filter_main_office_updater:
    Image|endswith:
      - '\OfficeC2RClient.exe'
      - '\OfficeClickToRun.exe'

  condition: selection_parent and selection_child and selection_suspicious_args and not 1 of filter_main_*
fields:
  - UtcTime
  - ParentImage
  - ParentCommandLine
  - Image
  - CommandLine
  - User
  - IntegrityLevel
  - ProcessId
  - ParentProcessId
falsepositives:
  - Complex business automation via macros (rare)
  - Office deployment scripts with legitimate encoded arguments (validate publisher/path)
level: critical

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f6e864ee-85d8-4338-b46a-aa2199f33818

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion