{"id":"e212d415-0e93-435f-9e1a-f29005bb4723","title":"Suspicious Remote Child Process From Outlook","description":"Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).","author":"Markus Neis, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2018-12-27","modified":"2023-02-09","tags":["attack.execution","attack.stealth","attack.t1059","attack.t1202"],"technique_ids":["T1059","T1202"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/sensepost/ruler","https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html","https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=49"],"source_path":"rules/windows/process_creation/proc_creation_win_office_outlook_susp_child_processes_remote.yml","source_sha256":"842d9d854cd0d337d6a1f9acc7b01f99b3c3c6faf5b8dca8bde8d92374ee4bbc","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_office_outlook_susp_child_processes_remote.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Remote Child Process From Outlook\nid: e212d415-0e93-435f-9e1a-f29005bb4723\nrelated:\n    - id: 208748f7-881d-47ac-a29c-07ea84bf691d # Outlook Child Processes\n      type: similar\nstatus: test\ndescription: Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).\nreferences:\n    - https://github.com/sensepost/ruler\n    - https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html\n    - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=49\nauthor: Markus Neis, Nasreddine Bencherchali (Nextron Systems)\ndate: 2018-12-27\nmodified: 2023-02-09\ntags:\n    - attack.execution\n    - attack.stealth\n    - attack.t1059\n    - attack.t1202\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\outlook.exe'\n        Image|startswith: '\\\\\\\\'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"},{"key":"enterprise/T1202","id":"T1202","name":"Indirect Command Execution","page":"techniques/enterprise/T1202/"}],"data_path":"data/detection-rules/e212d415-0e93-435f-9e1a-f29005bb4723.json","kind":"sigma"}