Outlook .msg open followed by OUTLOOK.EXE outbound SMB/WebDAV to public IP

Akhil Sable@kayshika

•updated today•4•0•17

Detects potential NTLM credential leaks where Outlook processes (.msg file handling or execution) are followed closely by outbound network connections on ports 445 (SMB) or 80 (HTTP/WebDAV) to external IP addresses.