Microsoft Outlook Spawning Suspicious Child Processes

Shadows VMB@Vemorian_Mort

•updated Aug 26, 2026•11•0•16

Detects instances where Microsoft Outlook (OUTLOOK.EXE) initiates common living-off-the-land (LotL) binaries that are often abused by malicious attachments or macros to execute secondary commands, such as PowerShell, command prompt, or script host engines.