Excel macro workbook (XLSM) spawning script or LOLBin child that decodes and run
Detects Microsoft Excel spawning script hosts or living-off-the-land binaries (LOLBins) with command line parameters indicative of decoding or executing payloads, commonly associated with malicious macro-enabled .xlsm workbooks.
Microsoft Sentinel (KQL)
