Malicious File Written to Office Trusted Location
Detects when a potentially malicious file (such as a macro-enabled document, executable, or script) is created within a directory configured as a Microsoft Office Trusted Location. Attackers may place malicious files in these locations to ensure they are opened by the user without security warnings (like Protected View or macro-blocking), facilitating code execution. This rule correlates file creation events with trusted paths dynamically enumerated from the device's registry.
Microsoft Sentinel (KQL)
