List of attachments sent from Outlook
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=ProcessRollup2
| CommandLine=/content.outlook/i
| aid=?aid
| ImageFileName=/(\/|\\)(?<FileName>\w*\.?\w*)$/
| FileName=/(winword|excel|powerpnt)\.exe/i
| CommandLine=/Outlook\\(?<ShortFile>\w*\\.*)$/i
| table([@timestamp, aid, TargetProcessId, ShortFile, CommandLine], limit=1000)attachments_send_by_outlook.yml
CrowdStrike
Hunting
Endpoint
Insight
2025-08-06
2025-08-28
