PowerShell Outlook COM Object for Email Harvesting

Danny Y@zendannyy

•updated Mar 21, 2026•1•0•175

Detects PowerShell script block logging events (Event Code 4104) that indicate the instantiation of the Outlook COM object via the MAPI namespace. This behavior is associated with malware like Horabot for email harvesting and spreading.