Suspicious Remote Child Process From Outlook

SigmaHQ Detections@sigmaHQ

•updated May 20, 2025•0•13

Detects a suspicious child process spawning from Microsoft Outlook where the executable image is located on a remote share (SMB/WebDav). This behavior is often associated with adversaries using Outlook to execute malicious code from network shares, potentially as part of persistence or execution techniques.