MS Office & Acrobat Reader Monitoring

July 9, 2024

Contributed by:

The ESA Threat Detection rules for monitoring Microsoft Office and Adobe Acrobat Reader are vast limits vendor rules.

Microsoft Office Rules

The rules in this section detect suspicious behavior with MS Office applications.

Detect macro execution with the default Office security configuration applied ("disable all macros with notification")
Detect child processes of Microsoft Office applications (dedicated rules for scripts and other types of child processes)
Detect Microsoft Office download operations
Detect Microsoft Office applications executing macros that access WMI to create child processes
Suspicious DLL load by Office
Detect loading of MAPI DLLs from processes other than Outlook

Adobe Acrobat Reader Rules

The rules in this section detect suspicious behavior with Adobe Acrobat Reader.

Detect child processes of Adobe Reader

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

MS Office & Acrobat Reader Monitoring

July 9, 2024

Contributed by:

July 9, 2024

Contributed by:

MS Office & Acrobat Reader Monitoring

Microsoft Office Rules

Adobe Acrobat Reader Rules

In this article