EQL hunt for Potential Macro on close

sequence by host.id with maxspan=1s
   [process where event.action : "creation_event" and 
    process.parent.name : ("winword.exe", "excel.exe", "powerpnt.exe") and 
    not (process.executable : ("?:\\Windows\\System32\\WerFault.exe", "?:\\WINDOWS\\splwow64.exe") and 
            process.args_count >= 2)
    ] by process.parent.entity_id
   [process where event.action : "termination_event" and 
    process.name : ("winword.exe", "excel.exe", "powerpnt.exe") and 
    process.parent.name : ("winword.exe", "excel.exe", "powerpnt.exe", "explorer.exe", "outlook.exe", "thunderbird.exe")
    ] by process.entity_id