Office Files with Password Keywords Accessed

Chale Maz@Bigcmaz

•updated Mar 17, 2026•22•0•235

This rule detects the access or creation of Microsoft Office files (docx, xlsx, pptx) that have 'password' or related keywords in their filename or folder path. It also attempts to identify if these files contain password-related content through DLP indicators, suggesting potential sensitive data exposure or staging.