APT28 GUID-like Script Files Dropped by Office
Detects a Microsoft Office application creating script files with GUID-like names in the user's profile directory. This is the primary method used by the "Operation MacroMaze" macro to drop its initial set of malicious scripts onto the victim's machine.
Sigma
