StealC Outlook Profile Registry Enumeration for Mail Credential Theft
This rule detects when an unusual process (not Outlook, MSOIA, OLK, or MicrosoftEdgeUpdate) queries registry keys associated with Microsoft Outlook profiles or the Windows Messaging Subsystem profiles. This activity could indicate an attempt to discover or access Outlook configuration, potentially for credential harvesting or data exfiltration.
Microsoft Sentinel (KQL)
