1. A computer-implemented method for evaluating a macro embedded in an event, comprising: providing an indicator in a regular event property that a macro is embedded in the event; generating a shadow property that is associated with the regular event property, wherein the shadow property comprises a binary representation of the macro; identifying the embedded macro from the indicator in the regular event property when the event triggers; accessing the binary representation of the macro in the shadow property; and evaluating the macro by determining whether actions in the macro are trusted.