Office Macro File Creation From Suspicious Process — Detection Rule

Detects the creation of a office macro file from a a suspicious process

Read the full analysis on IntelFusions