Suspicious child process: WINWORD.EXE spawned powershell.exe

Assign this alert to yourself to see the evidence and start investigating.