Suspicious Process Execution from Office Trusted Location
Detects when a suspicious process (such as a script interpreter or LOLBIN) is executed from a directory configured as a Microsoft Office Trusted Location. Attackers may place malicious executables or scripts in these locations to bypass security controls and execute them, often as a result of a user opening a malicious document.
Microsoft Sentinel (KQL)
