From 4ef8236992fb28e5ae3ef8b2e524cedbe3cd741c Mon Sep 17 00:00:00 2001 From: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Date: Mon, 11 May 2026 21:37:21 +0530 Subject: [PATCH] [Rule Tuning] Suspicious macOS MS Office Child Process (#6101) (cherry picked from commit 5c1c44a223bca112588728898be727924461cb9b) --- ...access_suspicious_mac_ms_office_child_process.toml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/rules/macos/initial_access_suspicious_mac_ms_office_child_process.toml b/rules/macos/initial_access_suspicious_mac_ms_office_child_process.toml index e7f5358d9..2f449b9ee 100644 --- a/rules/macos/initial_access_suspicious_mac_ms_office_child_process.toml +++ b/rules/macos/initial_access_suspicious_mac_ms_office_child_process.toml @@ -2,7 +2,7 @@ creation_date = "2021/01/04" integration = ["endpoint"] maturity = "production" -updated_date = "2026/03/24" +updated_date = "2026/05/07" [rule] author = ["Elastic"] @@ -123,7 +123,16 @@ process where event.action == "exec" and host.os.type == "macos" and "/Library/Elastic/Agent/*", "/opt/jc/bin/jumpcloud-agent", "/usr/sbin/networksetup" + ) and + not ( + process.name in ("sh", "bash") and + process.command_line like "*com.microsoft.Outlook/Data/tmp/Outlook*Temp*" and + process.parent.executable in ( + "/Applications/Microsoft Outlook.app/Contents/MacOS/Microsoft Outlook", + "/Applications/Microsoft Outlook 2.app/Contents/MacOS/Microsoft Outlook", + "/Applications/Microsoft/Microsoft Outlook.app/Contents/MacOS/Microsoft Outlook" ) + ) ''' note = """## Triage and analysis