See the following post to see how this ruleset can help you detect Emotet and other malicious document malware.
The 0805-sysmon-modular rules map to the Sysmon configuration by olafhartong and are tagged to the MITRE ATT&CK framework. You can find that at the following link.