T1566.001Initial Access

Spearphishing Attachment

The front door of most intrusions: a document that spawns a script host. The email is hard to catch reliably; the process lineage it creates is not. Here is the parent-child signature and the rules.

Run it live: Phishing to Lateral Movement

The full chain from a macro document that spawns PowerShell through to domain movement, on a real range with Sysmon feeding Wazuh.

Launch it

Spearphishing Attachment delivers a weaponized file, usually an Office document or a script, to a targeted user. The payload runs when they open it and enable content. You can filter and train against the email all day, and you should, but the reliable detection is one layer down: what the document does. A Word file that launches PowerShell is not normal, and that parent-child relationship is the signal.

What it looks like

Sysmon EID 1: ParentImage is winword.exe / excel.exe / outlook.exe, Image is powershell.exe / cmd.exe / wscript.exe / mshta.exe.
The child command line is encoded (-enc), hidden (-w hidden), or fetches a URL.
Follow-on network connection (Sysmon EID 3) to a first-seen domain.
Sometimes a file written to %APPDATA% or a scheduled task for persistence.

Detect it: Sigma

sigma / office-spawns-script-host.yml

title: Office Application Spawns a Script Interpreter
id: 0f1a2b3c-phsh-4d5e-6f70-tyrian000005
status: stable
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\\winword.exe'
      - '\\excel.exe'
      - '\\powerpnt.exe'
      - '\\outlook.exe'
    Image|endswith:
      - '\\powershell.exe'
      - '\\cmd.exe'
      - '\\wscript.exe'
      - '\\cscript.exe'
      - '\\mshta.exe'
      - '\\rundll32.exe'
  condition: selection
level: high
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.execution
  - attack.t1059

Detect it: Wazuh

wazuh / local_rules.xml

<group name="sysmon,phishing,attack,">
  <rule id="100110" level="12">
    <if_group>sysmon_event1</if_group>
    <field name="win.eventdata.parentImage">winword\.exe$|excel\.exe$|powerpnt\.exe$|outlook\.exe$</field>
    <field name="win.eventdata.image">powershell\.exe$|cmd\.exe$|wscript\.exe$|mshta\.exe$|rundll32\.exe$</field>
    <description>Phishing: Office app spawned a script interpreter (T1566.001)</description>
    <mitre>
      <id>T1566.001</id>
      <id>T1059</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Reduce the surface

Block macros from the internet with Group Policy (Microsoft now does this by default, verify it).
Use Attack Surface Reduction rules to stop Office spawning child processes.
Strip or sandbox risky attachment types at the mail gateway.
Alert on the Office → script-host lineage, then time how fast you'd catch a live phish.

Tyrian's Phishing to Lateral Movement scenario runs the whole chain, from the document that spawns PowerShell through to domain movement, on a real range with Sysmon feeding Wazuh, so you can watch the lineage rule fire on your own detections.

Test this detection on your own SIEM

Launch the Phishing to Lateral Movement range, fire T1566.001, and measure how fast you catch it. $5 free credit, no card.

Start free More techniques