Outlook/Word Exploit Crash
This rule detects potential exploit attempts targeting Microsoft Word or Outlook by monitoring process crashes (AccessViolation) initiated by these applications, specifically when the command line indicates the processing of document or email file types (.docx, .eml, .rtf). This could indicate an attempt to exploit a vulnerability in these applications through a specially crafted file.
Microsoft Sentinel (KQL)
