Suspicious Outlook Child Process

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection": {
    "ParentProcessName
| endswith": "\\OUTLOOK.EXE",
    "NewProcessName
| endswith": [
      "\\AppVLP.exe",
      "\\bash.exe",
      "\\cmd.exe",
      "\\cscript.exe",
      "\\forfiles.exe",
      "\\hh.exe",
      "\\mftrace.exe",
      "\\msbuild.exe",
      "\\msdt.exe",
      "\\mshta.exe",
      "\\msiexec.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\regsvr32.exe",
      "\\schtasks.exe",
      "\\scrcons.exe",
      "\\scriptrunner.exe",
      "\\sh.exe",
      "\\svchost.exe",
      "\\wmic.exe",
      "\\wscript.exe"
    ]
  },
  "condition": "process_creation and selection"
}

False Positives

• ⚠ Unknown