Office Macro File Creation From Suspicious Process

Detects the creation of a office macro file from a a suspicious process