Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution

Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started