CVE-2025-31978 — HCL BigFix Service Management (SM) does not adequately

title: CVE-2025-31978 - HCL BigFix SM Suspicious Spreadsheet Processing
id: scw-2026-05-06-ai-1
status: experimental
level: medium
description: |
  Detects the creation or modification of spreadsheet files (.csv, .xls, .xlsx) by HCL BigFix Service Management processes, which could indicate an attempt to exfiltrate data or execute malicious content via specially crafted spreadsheet content, as described in CVE-2025-31978.
author: SCW Feed Engine (AI-generated)
date: 2026-05-06
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2025-31978/
tags:
  - attack.initial_access
  - attack.t1566.002
logsource:
    category: file_event
detection:
  selection:
      TargetFilename|contains:
          - '.csv'
          - '.xls'
          - '.xlsx'
  selection_2:
      CommandLine|contains:
          - 'BigFix Service Management'
  condition: selection AND selection_2
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse