Microsoft Excel Add-In Loaded From Uncommon Location — Detection Rule

Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location

Read the full analysis on IntelFusions