Office Macro File Creation
This rule detects the creation of new Microsoft Office macro-enabled files. These file types (.docm, .dotm, .xlsm, .xltm, .potm, .pptm) can contain embedded macros, which are often used by adversaries for initial access, persistence, or execution of malicious code. Monitoring their creation can help identify suspicious activity related to macro-enabled document attacks.
Sigma
