Uncommon Microsoft Office Trusted Location Added
Detects modifications to registry keys related to Microsoft Office "Trusted Locations" where an uncommon path is added. Attackers may leverage this to bypass macro security restrictions by adding their malicious document locations as trusted.
Sigma
