olafhartong-sysmon-modular/7_image_load/include_office_com_load.xml

<Sysmon schemaversion="4.30">
  <EventFiltering>
    <RuleGroup name="" groupRelation="or">
      <ImageLoad onmatch="include">        <!-- Credit to @Antonlovesdnb https://blog.pwntario.com/team-posts/antons-posts/hunting-malicious-macros-->
        <Rule groupRelation="and">
          <Image condition="contains all">C:\Program Files;\Microsoft Office\root\Office</Image>
          <OriginalFileName name="technique_id=T1559.001,technique_name=Component Object Model" condition="is">combase.dll</OriginalFileName>
        </Rule>
        <Rule groupRelation="and">
          <Image condition="contains all">C:\Program Files;\Microsoft Office\root\Office</Image>
          <OriginalFileName name="technique_id=T1559.001,technique_name=Component Object Model" condition="is">coml2.dll</OriginalFileName>
        </Rule>
        <Rule groupRelation="and">
          <Image condition="contains all">C:\Program Files;\Microsoft Office\root\Office</Image>
          <OriginalFileName name="technique_id=T1559.001,technique_name=Component Object Model" condition="is">comsvcs.dll</OriginalFileName>
        </Rule>
      </ImageLoad>
    </RuleGroup>
  </EventFiltering>
</Sysmon>