Potentially Suspicious Office Document Executed From Trusted Location (f99abdf0-6283-4e71-bd2b-b5c048a94743)
Detects the execution of an Office application that points to a document that is located in a trusted location. Attackers often used this to avoid macro security and execute their malicious code.