Execution via Outlook Application COM Object

sequence with maxspan=1m
   /* Outlook started via DCOM */
 [process where event.action == "start" and
  process.name : "outlook.exe" and process. command_line : "*-Embedding*" and
  process.parent.name : "svchost.exe"] by process.entity_id
   /* Suspicious Outlook child processes */
 [process where event.action == "start" and
   process.pe.original_file_name :
               ("cscript.exe",
                "wscript.exe",
                "powershell.exe",
                "rundll32.exe",
                "cmd.exe",
                "mshta.exe",
                "msbuild.exe",
                "InstallUtil.exe",
                "Microsoft.Workflow.Compiler.exe",
                "wmic.exe",
                "regsvr32.exe",
                "pwsh.exe",
                "ScriptRunner.exe") and not
   /* Issue #330 */
   (process.name:"rundll32.exe" and process.args : ("--eoim", "--enable-speech-input")) and

   not (process.name : "rundll32.exe" and process.args : "?:\\WINDOWS\\sys*\\spool\\DRIVERS\\x64\\3\\*.dll,MonitorPrintJobStatus")] by process.parent.entity_id