Detection: Detect Outlook exe writing a zip file

 1
 2| tstats `security_content_summariesonly`  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe by _time span=5m Processes.parent_process_id Processes.process_id Processes.dest Processes.process_name Processes.parent_process_name Processes.user 
 3| `drop_dm_object_name(Processes)` 
 4| `security_content_ctime(firstTime)` 
 5| `security_content_ctime(lastTime)` 
 6| rename process_id as malicious_id
 7| rename parent_process_id as outlook_id
 8| join malicious_id type=inner[
 9| tstats `security_content_summariesonly` count values(Filesystem.file_path) as file_path values(Filesystem.file_name) as file_name  FROM datamodel=Endpoint.Filesystem where (Filesystem.file_path=*.zip*   OR Filesystem.file_name=*.lnk ) AND (Filesystem.file_path=C:\\Users* OR Filesystem.file_path=*Local\\Temp*) by  _time span=5m Filesystem.process_id Filesystem.file_hash Filesystem.dest  
10| `drop_dm_object_name(Filesystem)` 
11| `security_content_ctime(firstTime)` 
12| `security_content_ctime(lastTime)` 
13| rename process_id as malicious_id
14| fields malicious_id outlook_id dest file_path file_name file_hash count file_id] 
15| table firstTime lastTime user malicious_id outlook_id process_name parent_process_name file_name  file_path 
16| where file_name != "" 
17| `detect_outlook_exe_writing_a_zip_file_filter`