Title:Suspicious Execution From Outlook Temporary Folder Status:test Description:Detects a suspicious program execution in Outlook temp folder References: -Internal Research Author: Florian Roth (Nextron Systems) Date: 2019-10-01 modified:2022-10-09 Tags:
-'attack.initial-access'
-'attack.t1566.001'
Logsource:
category: process_creation
product: windows
Detection: selection: Image|contains:
'\Temporary Internet Files\Content.Outlook\' condition:selection Falsepositives:
-Unknown Level:high
