Initial Access or Execution via Microsoft Office Application

process where event.action == "exec" and
  descendant of [
    process where event.action == "exec" and
    process.name in (
      "Microsoft Word",
      "Microsoft Excel",
      "Microsoft PowerPoint",
      "Microsoft OneNote"
    )
  ] and
  process.name like~ (
    "curl",
    "nscurl",
    "bash",
    "sh",
    "osascript",
    "python*",
    "perl*",
    "mktemp",
    "chmod",
    "php",
    "nohup",
    "openssl",
    "plutil",
    "PlistBuddy",
    "xattr",
    "mktemp",
    "sqlite3",
    "funzip",
    "popen"
  ) and
  // Filter FPs related to product version discovery and Office error reporting behavior
  not process.args like~
    (
      "ProductVersion",
      "hw.model",
      "ioreg",
      "ProductName",
      "ProductUserVisibleVersion",
      "ProductBuildVersion",
      "/Library/Application Support/Microsoft/MERP*/Microsoft Error Reporting.app/Contents/MacOS/Microsoft Error Reporting",
      "open -a Safari *",
      "defaults read *",
      "sysctl hw.model*",
      "ioreg -d2 -c IOPlatformExpertDevice *",
      "ps aux
| grep 'ToDesk_Desktop'
| grep -v grep",
      "PIPE=\"$CFFIXED_USER_HOME/.zoteroIntegrationPipe*", 
      "/Library/Management/super/com.macjutsu.super.plist",
      "\"/Applications/Mendeley Desktop.app/Contents/MacOS/MendeleyWordPlugin.app/Contents/MacOS/MendeleyWordPlugin\" setPort *",
      "http://127.0.0.1:23119/integration/macWordCommand?*",
      "curl -s -o /dev/null -I -m 2 -w '%{http_code}' -X GET 'http://127.0.0.1:23119/integration/macWordCommand?agent=*'",
      "*/Applications/XLSTAT.app/*"
    ) and
   not process.parent.executable like~
        (
          "/Applications/ToDesk.app/Contents/MacOS/ToDesk_Service",
          "/usr/local/Privacy-i/PISupervisor",
          "/Library/Addigy/lan-cache",
          "/Library/Elastic/Agent/*",
          "/opt/jc/bin/jumpcloud-agent",
          "/usr/sbin/networksetup"
        ) and
   not (process.name == "sh" and process.command_line like~ "*$CFFIXED_USER_HOME/.zoteroIntegrationPipe*") and
   not (process.name in ("sh", "bash", "curl") and process.command_line like~ "*http://127.0.0.1:6969/binary*ppShuttle_*.bin*") and
   not process.Ext.effective_parent.executable like~ (
        "/Applications/ToDesk.app/Contents/MacOS/ToDesk_Service",
        "/Applications/Docker.app/Contents/MacOS/com.docker.backend",
        "/Applications/FortiClient.app/Contents/Resources/runtime.helper/FortiClientAgent.app/Contents/MacOS/FortiClientAgent",
        "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
        "/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon",
        "/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon",
        "/usr/local/Privacy-i/PISupervisor",
        "/usr/local/jamf/bin/jamf",
        "/Library/Addigy/auditor",
        "/Library/Elastic/Agent/*",
        "/opt/jc/bin/jumpcloud-agent",
        "/usr/sbin/networksetup"
      )