search for script launched

[cyberfan]

there are some malware enabled by word Macro and run VB script to communicate to outside. I want to find out what are the hosts open word document, VB script is executed (I don't know the word file name), any search can help? thanks

[richgalloway]

It depends. Are you logging sysmon in Splunk? Do you have any tools that log process data or communication outside your network?