Potential Excel XLL/Macro Abuse
This rule detects potential abuse of Microsoft Excel where a process other than Excel itself is launched by Excel. This behavior can be indicative of malicious Excel add-ins (XLLs) or macros executing external code, a common technique used in phishing campaigns and malware delivery. The rule specifically looks for `excel.exe` as the parent process and a different executable (`ImageFileName`) as the child process.
CQL
