All Detections

Office Macro Template Downloaded for Persistence

avatar
Darshan Thummar@Mighty
updated Jun 13, 2026002

Detects download of macro-enabled Office templates for persistent macro execution

Microsoft Sentinel (KQL)