this will alert on legitimate macro usage as well, additional tuning is required

source: <a href=https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_office_trust_record_modification.yml>sigma
technicques: t1566 t1566.001

Techniques

Alerts on trust record modification within the registry, indicating usage of macros

condition: selection
selection:
  TargetObject|contains: \Security\Trusted Documents\TrustRecords