IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
Elastic Docs ›SIEM Guide [7.6] ›Detections (Beta) ›Prebuilt rule reference
« Suspicious MS Office Child Process Suspicious Process spawning from Script Interpreter »

Suspicious MS Outlook Child Processedit

Identifies suspicious child processes of Microsoft Outlook. These child processes are often associated with spear phishing activity.

Rule indices:

  • winlogbeat-*

Severity: low

Risk score: 21

Runs every: 5 minutes

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum signals per execution: 100

Tags:

  • Elastic
  • Windows

Rule version: 1

Added (Elastic Stack release): 7.6.0

Rule queryedit

event.action:"Process Create (rule: ProcessCreate)" and
process.parent.name:"outlook.exe" and process.name:("arp.exe" or
"dsquery.exe" or "dsget.exe" or "gpresult.exe" or "hostname.exe" or
"ipconfig.exe" or "nbtstat.exe" or "net.exe" or "net1.exe" or
"netsh.exe" or "netstat.exe" or "nltest.exe" or "ping.exe" or
"qprocess.exe" or "quser.exe" or "qwinsta.exe" or "reg.exe" or
"sc.exe" or "systeminfo.exe" or "tasklist.exe" or "tracert.exe" or
"whoami.exe" or "bginfo.exe" or "cdb.exe" or "cmstp.exe" or "csi.exe"
or "dnx.exe" or "fsi.exe" or "ieexec.exe" or "iexpress.exe" or
"installutil.exe" or "Microsoft.Workflow.Compiler.exe" or
"msbuild.exe" or "mshta.exe" or "msxsl.exe" or "odbcconf.exe" or
"rcsi.exe" or "regsvr32.exe" or "xwizard.exe" or "atbroker.exe" or
"forfiles.exe" or "schtasks.exe" or "regasm.exe" or "regsvcs.exe" or
"cmd.exe" or "cscript.exe" or "powershell.exe" or "pwsh.exe" or
"wmic.exe" or "wscript.exe" or "bitsadmin.exe" or "certutil.exe" or
"ftp.exe")

Threat mappingedit

Framework: MITRE ATT&CKTM

« Suspicious MS Office Child Process Suspicious Process spawning from Script Interpreter »