Exploitation for Client Execution (T1203) is code execution bought with a document, not a login: the attacker weaponizes a bug in Word, Excel, a PDF reader, or a browser so that opening a file runs their code. The clearest catch is not the exploit itself but its aftermath: Office or reader processes almost never spawn cmd.exe, powershell.exe, or rundll32.exe on their own.
Practice detecting Exploitation for Client Execution on realistic SIEM, XDR alerts in SOCSimulator Operations.
“Exploitation for Client Execution is documented as technique T1203 in MITRE ATT&CK® v19.1 under the Execution tactic. Detection requires visibility into SIEM, XDR telemetry.”
The attacker starts with a bug, not a login: a memory-corruption or logic flaw in a client application that turns attacker-controlled input into code execution. The best-documented example is CVE-2017-11882 in Microsoft Equation Editor (EQNEDT32.EXE), where crafted equation data in an embedded OLE object overflows a fixed buffer and overwrites a return address, handing control to the attacker inside a 32-bit process that has been unchanged since Office 2000. A single opened document is enough; there is no macro prompt to click through, because the exploit runs before any macro-security dialog would appear.
From that first-stage code execution, the payload typically calls WinExec() or CreateProcess() to launch a living-off-the-land binary, most often rundll32.exe pointed at a file it just wrote to a temp or AppData path, using a non-.dll extension like .pdf or .png to slip past extension-based filters. That LOLBin then decodes and loads the real payload, frequently reflectively injecting it into a second, dormant system process such as ImagingDevices.exe or RegSvcs.exe via process hollowing, so nothing malicious ever touches disk as an unpacked executable.
Delivery does not require the exploit to sit in the visible attachment. Word's altChunk feature lets a .docx silently load a second file, typically an RTF, from within the archive, so a scanner that only inspects the outer document misses the payload entirely. Persistence usually lands as a Run key or a copy of the loader dropped into %AppData%, so the exploit chain hands off to ordinary commodity malware behavior within seconds of the document opening.
Exploitation for Client Execution sits at the initial-access-to-execution boundary: a phishing email or drive-by download (T1566) delivers the weaponized file, the user opens it (T1204, User Execution), and the exploit itself is the execution event this technique names. What follows is almost always a commodity loader stage, process injection into a trusted binary, then a C2 check-in, credential or browser-data theft, and onward persistence, rather than a bespoke post-exploitation toolkit.
FortiGuard Labs documented this exact chain in April 2025: a phishing email carrying a purchase-order-themed .docx that pulled in an external RTF via altChunk, exploited CVE-2017-11882 in Equation Editor, and used the resulting code execution to run rundll32.exe against a renamed DLL disguised as a PDF, ultimately process-hollowing FormBook into the Windows Photo Viewer's ImagingDevices.exe. Splunk's Security Content team documents the same Office-to-LOLBin pivot recurring across IcedID, Trickbot, Remcos, AgentTesla and Qakbot campaigns, which is why the detection is written around the parent-child pairing rather than any single malware family's signature.
The following detection strategies help SOC analysts identify Exploitation for Client Execution activity. These methods apply across SIEM, XDR environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.
| tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
WHERE Processes.parent_process_name IN ("WINWORD.EXE","EXCEL.EXE","POWERPNT.exe","EQNEDT32.EXE","MSPUB.exe","wordpad.exe")
Processes.process_name IN ("cmd.exe","powershell.exe","rundll32.exe","regsvr32.exe","mshta.exe","wscript.exe")
BY Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`Adapts Splunk Security Content's 'Windows Office Product Spawned Uncommon Process' and 'Windows Office Product Spawned Rundll32 With No DLL' analytics: any of the core Office parents launching a scripting or LOLBin child is the finding, authored around IcedID, FormBook and Trickbot loader behavior.
EventID: 1
UtcTime: 2026-07-16 09:41:07.098
Image: C:\Windows\System32\rundll32.exe
CommandLine: rundll32.exe %TEMP%\AdobeID.pdf,IEX
ParentImage: C:\Program Files\Microsoft Office\root\Office16\EQNEDT32.EXE
ParentCommandLine: "EQNEDT32.EXE" -Embedding
User: CORP\jmartin
Computer: WS-ACCT-07.corp.localdetection:
selection_parent:
ParentImage|endswith:
- '\EQNEDT32.EXE'
- '\EXCEL.EXE'
- '\MSPUB.exe'
- '\POWERPNT.exe'
- '\WINWORD.EXE'
- '\wordpad.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
- '\mshta.exe'
- '\wscript.exe'
- '\cscript.exe'
condition: all of selection_*Condensed from SigmaHQ's 'Suspicious Microsoft Office Child Process' rule (id 438025f9), which lists EQNEDT32.EXE alongside the full Office suite as parents and flags the LOLBin family attackers pivot to right after a client-side exploit lands.
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("WINWORD.EXE","EXCEL.EXE","EQNEDT32.EXE","POWERPNT.EXE")
| where FileName =~ "rundll32.exe"
and ProcessCommandLine !contains ".dll"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLineMirrors the no-.dll rundll32 pattern Splunk's analytic keys on: an Office-spawned rundll32.exe pointed at a renamed non-DLL file is the exact loader step FormBook and IcedID use after exploiting Equation Editor or a macro-less document.
Timestamp: 2026-07-16T09:41:07.113Z
DeviceName: WS-ACCT-07.corp.local
FileName: rundll32.exe
ProcessCommandLine: rundll32.exe C:\Users\jmartin\AppData\Roaming\Templates\AdobeID.pdf,IEX
InitiatingProcessFileName: EQNEDT32.EXE
InitiatingProcessCommandLine: "C:\Program Files\Microsoft Office\root\Office16\EQNEDT32.EXE" -Embedding
AccountName: CORP\jmartinLegitimate add-ins, document-conversion utilities, mail-merge macros, and some enterprise DRM or e-signature tools do spawn helper processes from Office applications, and a handful of older line-of-business tools still register COM objects through regsvr32 launched from a macro. None of these, however, normally originate from EQNEDT32.EXE, since Equation Editor has had no legitimate reason to spawn a process since it was deprecated in 2018.
Tune by parent first: treat any EQNEDT32.EXE child as near-zero false-positive territory and alert unconditionally, then apply an allow-list to the broader WINWORD.EXE and EXCEL.EXE parent rules for the specific macro-driven business processes your organization actually runs, keyed on the exact child binary, command-line pattern, and the signing certificate of the document's source. A rundll32.exe invocation with a proper .dll target and a known internal path is a much weaker signal than the same binary pointed at a file with no .dll extension sitting in AppData or Temp.
These realistic alert examples show what Exploitation for Client Execution looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.
WINWORD.EXE on WS-ACCT-07.corp.local opened a purchase-order attachment, loaded an external RTF via altChunk, and EQNEDT32.EXE crashed and relaunched as the parent of rundll32.exe C:\Windows\System32\rundll32.exe %TEMP%\AdobeID.pdf,IEX. No .dll extension and an Equation Editor parent are both abnormal.
EXCEL.EXE on a finance workstation spawned powershell.exe -enc with the working directory set to %AppData%\Templates\, seconds after the user opened an emailed invoice. The user never enabled macros, consistent with an exploit-driven spawn rather than VBA execution.
Following the rundll32.exe child of EQNEDT32.EXE, a new thread was injected into C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe with CREATE_SUSPENDED flags. Injection into a normally dormant system binary immediately after an Office-spawned child is consistent with FormBook's loader stage.
First, confirm which Office process actually spawned the child and whether it matches a known-benign automation workflow; if the parent is EQNEDT32.EXE, skip that question and treat it as active exploitation. Next, read the child's command line for a renamed payload (a rundll32 or regsvr32 target with no matching .dll extension, or a path under AppData\Templates or Public), and check whether the document arrived by email in the last few minutes, since the exploit-to-child-process gap is normally seconds.
If the pattern holds, escalate immediately rather than waiting for AV or sandbox verdicts: isolate the host to stop the loader from completing its C2 check-in or credential theft, and capture the still-running process tree and any injected-into binary before killing anything, since that is your best evidence of the payload family. Pull the original email or download source to identify other recipients who received the same attachment, and rotate credentials for any accounts active on the host at the time, since infostealer payloads like FormBook and AgentTesla are commonly the next stage after this exact exploit chain.
Investigate Exploitation for Client Execution on realistic SIEM, XDR, and firewall consoles, free.
An Indicator of Compromise (IOC) is an observable artifact, such as a file hash, IP address, domain name, URL, registry …
Read more GlossaryEndpoint Detection and Response (EDR) is a security technology that continuously monitors endpoint activity, recording p…
Read more GlossaryAlert triage is the structured process of reviewing, prioritizing, and investigating security alerts to determine their …
Read more GlossaryTactics, Techniques, and Procedures (TTPs) describe the behavioral patterns, methods, and operational processes threat a…
Read more Career PathTier 2 SOC Analysts handle the investigations that Tier 1 escalates. You dig into multi-stage attacks, coordinate contai…
Read more Career PathIncident Responders lead the technical response when confirmed breaches happen. You coordinate containment, run forensic…
Read more ToolThe SIEM console in SOCSimulator replicates the workflow of enterprise platforms like Splunk Enterprise Security, Micros…
Read more ToolThe XDR console in SOCSimulator replicates the investigation workflow of platforms like CrowdStrike Falcon, Microsoft De…
Read more ComparisonSOCSimulator wins on operational realism. You get multi-tool shift simulation with SLA pressure, noise injection, and al…
Read more GlossaryComplete glossary of Security Operations Center terminology for aspiring SOC analysts.
Read more FeaturePractice alert triage under realistic time pressure with SLA timers and noise injection.
Read more FeatureStructured CTF-style investigation operations covering real-world attack scenarios.
Read more