Process Creation via Microsoft Office Add-Ins

process where event.action == "start" and
 process.parent.name : ("winword.exe", "excel.exe") and
 _arraysearch(process.parent.thread.Ext.call_stack, $entry,
              $entry.symbol_info :
                               ("*!xlAutoOpen*", "*!wlAutoOpen*", "*!wdAutoOpen*", "?:\\Users\\*\\Microsoft\\Word\\STARTUP\\*",
	                            "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\AddIns\\*",
	                            "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*")) and
 not (process.code_signature.subject_name : "FactSet Research Systems Inc." and process.code_signature.trusted == true) and 
 not process.executable : "?:\\Windows\\splwow64.exe" and 
 not process.hash.sha256 : "b52ee82c7e579fd73abc31c368462df9d99c6623be91526ee150706286dc19ee" and
 not (process.parent.name : "Excel.exe" and process.name : "csc.exe" and
      process.parent.args : "https://*.sharepoint.com/sites/*" and process.parent.args : "/cid")