From 245bd2ac030c16bb496cabe20e670263c7f46757 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 25 Nov 2024 15:48:05 -0700
Subject: [PATCH] Update detections/endpoint/windows_rdp_file_execution.yml

Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
---
 detections/endpoint/windows_rdp_file_execution.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detections/endpoint/windows_rdp_file_execution.yml b/detections/endpoint/windows_rdp_file_execution.yml
index f3f7d8d007..acc2b0720b 100644
--- a/detections/endpoint/windows_rdp_file_execution.yml
+++ b/detections/endpoint/windows_rdp_file_execution.yml
@@ -20,6 +20,7 @@ search: '| tstats count min(_time) as firstTime max(_time) as lastTime from data
       match(process, "\\\\Downloads\\\\"), "downloads_execution",
       match(process, "\\\\Temp\\\\"), "temp_execution",
       match(process, "\\\\Microsoft\\\\Outlook\\\\"), "outlook_execution",
+      match(process, "\\\\Olk\\\\Attachments\\\\"), "outlook_execution",
       match(process, "\\\\Content.Outlook\\\\"), "outlook_execution",
       true(), "other"
   ),