Analytics BIOC
Informational
✕
Possible Email collection using Outlook RPC
Outlook was executed using RPC by an uncommon parent process, this may be an indication of email collection activities.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Collection (TA0009)
ATT&CK techniques: Email Collection: Local Email Collection (T1114.001)
Attacker's goals:
An attacker is trying to perform email collection or manipulation using Outlook.
Investigative actions:
Investigate the endpoint to determine if it's a legitimate process that is supposed to use Outlook in its operation to send or extract emails.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day