Potentially Suspicious Office Document Executed From Trusted Location
Detects the execution of a Microsoft Office application (Excel, PowerPoint, Word) that attempts to open a document located in a trusted Microsoft Office location. Attackers often leverage this technique to bypass macro security warnings and execute malicious code, as documents in trusted locations may not trigger security prompts. The rule specifically looks for parent processes like explorer.exe or dopus.exe launching these Office applications with command-line arguments pointing to documents within known trusted paths such as AppData\Roaming\Microsoft\Templates or Microsoft Office\root\Templates. It filters out common template file extensions (.dotx, .xltx, .potx) to reduce false positives.
Sigma
