Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
1
1
Categories
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
1
1
CVEs
71
71
64
57
49
KQL Query from file: High Fidelity Outlook Zero-Day Detection
Detects OUTLOOK.EXE connecting to public IP addresses over SMB (445/139), which Outlook does not normally do. May indicate forced NTLM authentication and NTLMv2 hash leakage via a crafted message file (CVE-2026-124194, exploited in the wild). The exact file extension of the trigger is not confirmed; likely candidates are .msg and possibly other Outlook message formats (.eml, .oft).
