Snort detects traffic that is targeting vulnerabilities in files that belong to software in the...

Cisco Firepower Management Center (FMC), when configured with Snort rules, classifies attacks with signature categories such as FILE-OFFICE for Microsoft Office-based exploits. One of the critical threats involving Microsoft Office is a known vector involving Microsoft Graphics, which attackers exploit for remote code execution (RCE). RCE vulnerabilities enable attackers to execute arbitrary commands or code on the target machine—making this classification high-severity.

The alert "FILE-OFFICE Microsoft Graphics remote code execution attempt" is consistent with what Cisco and Snort define for such threats and appears in rulesets addressing vulnerabilities like CVE-2017-0001.