gistfile1.txt

sequence with maxspan=1m
 [file where event.action != "deletion" and 
   file.extension : "doc*" and 
   /* xml or mht file header renamed as doc smuggling maldoc */
   file.Ext.header_bytes : ("3c3f786d6c2076657273696f6e*", "4d494d452d56657273696f6e3a*") and 
    process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE")] by process.entity_id
 [process where event.action == "start" and 
  process.parent.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE")] by process.parent.entity_id