See https://medium.com/@john.woodman11/vba-macro-remote-template-injection-with-unlinking-self-deletion-49aef5eec0cd

Potential keywords:

• .VBComponents.Remove
• .CodeModule.DeleteLines
• .AttachedTemplate (but this one will trigger false positives, it is just an indication that the macro manipulates the attached template)