• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Suspicious Outlook Child Process

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    SigmaHQ Detections@sigmaHQ
    •updated Aug 12, 2024•0•20

    Detects suspicious child processes spawned from Microsoft Outlook. This often indicates an attempt to execute malicious code or scripts via social engineering or exploitation of vulnerabilities within Outlook.

    Sigma

    Tags

    T1204.002 - Malicious FileT1047 - Windows Management InstrumentationT1204 - User ExecutionTA0002 - ExecutionProcess CreationWindowsWindows Eventlog SecurityCVE-2022-30190attack.executionattack.t1204.002

    Found in

    • ExfilSquad Emerging Extortion Threat via SaaS MisconfigurationsLast updated Sep 9, 2026

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?