Office Macro File Creation From Suspicious Process
This rule detects the creation of Microsoft Office macro-enabled files (docm, dotm, xlsm, xltm, potm, pptm) when the creating process or its parent process is a suspicious utility often abused by adversaries. The suspicious utilities include cscript.exe, mshta.exe, regsvr32.exe, rundll32.exe, and wscript.exe. This behavior is indicative of potential initial access or execution techniques where malicious macros are delivered or generated.
Sigma
