emotet.yml

gistfile1.txt

title: Possible emails/attachmets extraction by Emotet
description: Detects Emotet malware component, that extract emails and attachments from outlook.
author: Den Iuzvyk
detection:
  condition: selection and not filter
  selection:
    EventID: 7
    ImageLoaded|endswith: mapi32.dll
  filter:
    Image|endswith: outlook.exe
falsepositives:
- unknown
level: high
logsource:
  category: sysmon
  product: windows
reference:
- https://twitter.com/MalwareTechBlog/status/1288204486444376065
status: experimental
tags:
- attack.collection