Soc Root 🔴 Query for Splunk index=sysmon EventCode=11 TargetFilename="*.docm" OR TargetFilename="*.xlsm" OR TargetFilename="*.pptm" OR TargetFilename="*.dotm" OR TargetFilename="*.xltm" | table _time Computer User TargetFilename Image @Socroot

• 🗿 5