Suspicious COM CLSID Registry Value Set By Outlook.EXE

Nasreddine Bencherchali (Nextron Systems)

Detects the creation of a COM CLSID pointing to a DLL file residing in the Outlook Forms directory. This is could potentially indicate the installation of a malicious Outlook Form. Investigate further action executed during this time frame and look for a DLL being dropped to disk and then that same DLL being loaded by the Outlook process.

2024-03-12 00:00:00

None

7f812f92-eccd-4a2c-8f93-aefc8add99b0

attack.persistence

Nextron Sigma feed only (private)