winword.exe

Microsoft Office's word processor application. tldr-pages

LOLBAS Download 5 Sigma rules name it 2 ATT&CK techniques 1 documented command 1 known copy with hashes

How winword.exe is abused

documented by LOLBAS

Download T1105 Ingress Tool Transfer

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for winword.exe.

1 documented command

from LOLBAS, each read by the identifier

Download T1105 Ingress Tool Transfer User privileges

Downloads payload from remote server

winword.exe {REMOTEURL}

Identify

Trips 1 Sigma rule: highPotential Arbitrary File Download Using Office Application by Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community

The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for winword.exe, by Reegun J (OCBC Bank), at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for winword.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumPotential Arbitrary DLL Load Using WinwordVictor Sergeev, oscd.community

highPotential Arbitrary File Download Using Office ApplicationNasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community

highPotentially Suspicious Office Document Executed From Trusted LocationNasreddine Bencherchali (Nextron Systems)

highRenamed Office Binary ExecutionNasreddine Bencherchali (Nextron Systems)

mediumSuspicious New Instance Of An Office COM ObjectNasreddine Bencherchali (Nextron Systems)

T1105Ingress Tool Transfer

T1202Indirect Command Execution

Is it the real winword.exe?

file version info and known copies

Installed inC:\Program Files (x86)\Microsoft Office\root\Office16\

Signed byMicrosoft Corporation

ProductMicrosoft Office, Microsoft Corporation

DescriptionMicrosoft Word

1 known copy

16.0.12527.20482 · C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE · signed by Microsoft Corporation

75d216cde89d62ae1f9a8137ce7ee32fec7a1da96826be471e664223651720bc

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

Everyday use

from tldr-pages, CC BY 4.0

Launch the word processor application (omitting the file path will launch the File page)

winword path\to\file.docxIdentify

Launch Word with no open documents

winword /nIdentify

write a new blank document

winword /wIdentify

None of the 3 examples the identifier reads matches LOLBAS abuse or trips a Sigma process-creation rule.