New Office Trusted Location Registry Addition
Detects the creation of a new Microsoft Office Trusted Location via registry modification. Attackers abuse this feature to add a location they control, allowing macros or other active content to run without security warnings, bypassing Mark-of-the-Web (MotW) protections.
Microsoft Sentinel (KQL)
