[[ fm.text ]] Click here

Microsoft Office child process spawn of LOLBin (CVE-2026-20957)

SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Apache-2.0

Detects Office apps spawning LOLBin child processes. BROAD hunting rule for CVE-2026-20957 Excel integer underflow RCE exploitation chains.

title: Microsoft Office child process spawn of LOLBin (CVE-2026-20957)
id: 0a8e2b74-5d1e-4b1c-bc6e-81a42a3f0b91
status: experimental
description: |
  Detects Office apps spawning LOLBin child processes. BROAD hunting rule for CVE-2026-20957 Excel integer underflow RCE exploitation chains. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
  Détecte des applications Microsoft Office lançant des processus enfants suspects. Comportement couramment observé lors de l'exploitation de vulnérabilités Office, incluant CVE-2026-20957 (RCE via integer underflow Excel). Règle BROAD : bruit attendu depuis les add-ins et l'automatisation légitime. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
related:
  - id: c36280ec-bbdd-4e2a-9a60-19c20eec2590
    type: similar

references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-20957
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20957
author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-01-18
modified: 2026-06-19
tags:
  - attack.execution
  - attack.t1059
  - cve.2026-20957
logsource:
  category: process_creation
  product: windows

detection:
  selection_parent_office:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\msaccess.exe'

  selection_child_exec:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\msiexec.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
      - '\curl.exe'
      - '\schtasks.exe'
      - '\reg.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\sc.exe'
      - '\forfiles.exe'
      - '\pcalua.exe'
      - '\odbcconf.exe'
      - '\wmic.exe'
      - '\msbuild.exe'
      - '\installutil.exe'
      - '\ieexec.exe'
      - '\xwizard.exe'

  # Standard COM/OLE invocation used by integrations: /pt expects trailing space to avoid partial match
  filter_main_office_automation:
    ParentCommandLine|contains:
      - '/automation'
      - '/pt '
      - '/embedding'

  # Known helper processes spawned by Office for printing, error reporting, etc.
  # Note: conhost.exe, dllhost.exe, splwow64.exe, WerFault.exe are NOT in selection_child_exec
  # so this filter is kept as a safety net for edge cases where image list is extended
  filter_main_office_helpers:
    Image|endswith:
      - '\OfficeC2RClient.exe'
      - '\OfficeClickToRun.exe'

  condition: selection_parent_office and selection_child_exec and not 1 of filter_main_*

fields:
  - UtcTime
  - ParentImage
  - ParentCommandLine
  - Image
  - CommandLine
  - User
  - IntegrityLevel
  - ProcessId
  - ParentProcessId

falsepositives:
  - Legitimate Office automation and macros spawning helper processes
  - Software deployment or update agents launched from Office templates
  - Authorized VBA/COM add-ins executing system utilities during normal operations

level: medium

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f3463f7b-9c31-4820-b625-cd9a3935d0be

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion