Suspicious Remote Child Process From Outlook — Detection Rule
Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).
Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).