Untrusted File Execution via Microsoft Office

sequence by user.id with maxspan=1m
  [file where event.action != "deletion" and
    (file.extension : ("exe", "com", "pif", "scr") or file.Ext.header_bytes : "4d5a*") and
    process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE") and
    not file.path :
            (
              "?:\\Users\\*\\Downloads\\*",
              "?:\\Users\\*\\AppData\\Local\\Temp\\*-*-*-*\\*",
              "?:\\Program Files (x86)\\*",
              "?:\\Program Files\\*"
            )
    ] by file.path
  [process where event.action == "start" and
    process.parent.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE") and
    not process.code_signature.trusted == true] by process.executable