Suspicious Microsoft Office Child Process - MacOS (69483748-1525-4a6c-95ca-90dc8d431b68)

Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Suspicious Microsoft Office Child Process - MacOS (69483748-1525-4a6c-95ca-90dc8d431b68)	Sigma-Rules	Office Test - T1137.002 (ed7efd4d-ce28-4a19-a8e6-c58011eb2c7a)	Attack Pattern	1
Suspicious Microsoft Office Child Process - MacOS (69483748-1525-4a6c-95ca-90dc8d431b68)	Sigma-Rules	AppleScript - T1059.002 (37b11151-1776-4f8f-b328-30939fbf2ceb)	Attack Pattern	1
Suspicious Microsoft Office Child Process - MacOS (69483748-1525-4a6c-95ca-90dc8d431b68)	Sigma-Rules	Malicious File - T1204.002 (232b7f21-adf9-4b42-b936-b9d6f7df856e)	Attack Pattern	1
Office Test - T1137.002 (ed7efd4d-ce28-4a19-a8e6-c58011eb2c7a)	Attack Pattern	Office Application Startup - T1137 (2c4d4e92-0ccf-4a97-b54c-86d662988a53)	Attack Pattern	2
AppleScript - T1059.002 (37b11151-1776-4f8f-b328-30939fbf2ceb)	Attack Pattern	Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830)	Attack Pattern	2
User Execution - T1204 (8c32eb4d-805f-4fc5-bf60-c4d476c131b5)	Attack Pattern	Malicious File - T1204.002 (232b7f21-adf9-4b42-b936-b9d6f7df856e)	Attack Pattern	2