diff --git a/detections/endpoint/windows_rdp_file_execution.yml b/detections/endpoint/windows_rdp_file_execution.yml
index f3f7d8d007..acc2b0720b 100644
--- a/detections/endpoint/windows_rdp_file_execution.yml
+++ b/detections/endpoint/windows_rdp_file_execution.yml
@@ -20,6 +20,7 @@ search: '| tstats count min(_time) as firstTime max(_time) as lastTime from data
       match(process, "\\\\Downloads\\\\"), "downloads_execution",
       match(process, "\\\\Temp\\\\"), "temp_execution",
       match(process, "\\\\Microsoft\\\\Outlook\\\\"), "outlook_execution",
+      match(process, "\\\\Olk\\\\Attachments\\\\"), "outlook_execution",
       match(process, "\\\\Content.Outlook\\\\"), "outlook_execution",
       true(), "other"
   ),