Detect Office Template Macros in Elastic Security

sequence by host.name with maxspan=5m
[
  any where (
    (
      event.category == "file" and event.action in ("creation", "modification") and
      (
        file.name in~ ("Normal.dotm", "PERSONAL.XLSB", "NormalEmail.dotm") or
        file.path like~ "*\\AppData\\Roaming\\Microsoft\\Templates\\*" or
        file.path like~ "*\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*" or
        file.path like~ "*\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*" or
        file.path like~ "*\\Program Files (x86)\\Microsoft Office\\root\\*"
      ) and
      not process.name in~ ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "MicrosoftEdgeUpdate.exe", "OfficeClickToRun.exe")
    ) or
    (
      event.category == "registry" and event.action in ("modification", "creation") and
      (
        registry.path like~ "*Microsoft*Word*GlobalDotName*" or
        registry.value like~ "*GlobalDotName*"
      )
    )
  )
] by process.entity_id

// Supplemental: Office spawning suspicious child
sequence by host.name with maxspan=1m
[
  process where event.type == "start" and
    process.parent.name in~ ("winword.exe", "excel.exe", "powerpnt.exe") and
    process.name in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "msiexec.exe")
]