Malicious Office Template with Macro Downloaded
This rule detects the download of Office template files (such as .dot, .dotm, .xlt, .xltm, .pot, .potm) that contain VBA project content. This is indicative of potentially malicious Office documents designed to execute macros, often used for initial access or persistence by attackers.
Suricata
