Office Macro File Download by Browser or Email Client
Detects the creation of new Office macro files on systems via applications such as web browsers or email clients. This rule identifies files with common Office macro extensions (.docm, .dotm, .xlsm, .xltm, .potm, .pptm) or those with Zone.Identifier streams indicating a download, when created by known browser or email client processes.
Sigma
