Microsoft Outlook Process Execution with UPN Argument

Shadows VMB@Vemorian_Mort

•updated Aug 26, 2026•3•0•5

This rule monitors the execution of the Outlook process (olk.exe) where the command line contains the argument 'upn='. This pattern is often associated with the manual invocation of Outlook components or potential credential manipulation, as user principal names (UPNs) are frequently used in authentication workflows and may be targeted or misused.