Macro Enabled In A Potentially Suspicious Document Location
Detects registry changes to Office trust records where the path is located in a potentially suspicious location, indicating that a macro-enabled document from an unusual or untrusted location has been allowed to run. This could be indicative of an attempt to bypass security controls by executing malicious macros from temporary folders, internet caches, or public user directories.
Sigma
