Detection idea: flagging unusual parent-child process chains

Sharing a Sigma rule draft for Office apps spawning scripting hosts, plus the false positives I've seen in real environments.