MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1204.002Malicious File

Execution

View on MITRE ATT&CK →

1 Query

Suspicious Process Launched from Office Application

highproductionDefender XDR

Microsoft Defender for Endpoint·DeviceProcessEvents

let OfficeApps = dynamic(["winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "msaccess.exe", "mspub.exe"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe"]);
DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessFileName in~ (OfficeApps)
| where FileName in~ (SuspiciousChildren)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

Microsoft (adapted) · last tested 2025-03-01

Tuning notes

Office add-ins and COM automation can spawn child processes. Exclude known legitimate add-in process names specific to your environment.

+ Add another query for this technique →