Document_New macro

Document_New is the ThisDocument event that runs when a new document is created from a template. It is the modern equivalent of AutoNew and is used by the same template-infecting macro-virus families. Rated LOW because it is a capability/context marker, not evidence of malice: it says the macro runs without the user pressing anything. Benign templates use these triggers legitimately, so a real dropper still convicts on its Shell/download/LOLBin signal — this trigger is never the sole malicious signal.