Hello
Thank you for your question and reaching out. I can understand you are having query related to Microsoft Office macro executions.
You can try in Defender Portal logs were capturing .docm/.xlsm files being opened, including their paths.
Also , There is a tool "Readiness Toolkit tool" for Office add-ins and VBA.
https:// learn.microsoft.com/en-us/deployoffice/readiness-tools#readiness-toolkit-for-office-add-ins-and-vba
---
--If the reply is helpful, please Upvote and Accept as answer--