CLR DLL Loaded Via Office Applications — Detection Rule

Detects CLR DLL being loaded by an Office Product

Read the full analysis on IntelFusions