Office Trusted Locations Expanded Scope Enabled
Detects when the 'AllowNetworkLocations' or 'AllowSubfolders' registry values are enabled for Microsoft Office. This change broadens the attack surface by allowing Office to trust documents from network shares or any subdirectory within a trusted path, which can be abused by attackers to execute malicious payloads from attacker-controlled shares or hidden directories.
Microsoft Sentinel (KQL)
