Suspicious Execution From Outlook Temporary Folder
This rule detects the execution of any program from the Outlook temporary files folder, which is often used by adversaries to drop and execute malicious payloads received via email. This activity is highly suspicious as legitimate applications typically do not execute from this location.
Sigma
