75bf09fa-1dd7-4d18-9af9-dd9e492562eb False positive with outlook.exe

[nekopep]

Rule UUID

75bf09fa-1dd7-4d18-9af9-dd9e492562eb

Example EventLog

Process name OUTLOOK.EXE (pid=11388)
Image name C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
Command-line C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
Execution Detected
Current directory C:\Windows\System32
Process Create Time 2023-09-07 09:08:54Z
Size 41008072 (39.11 MiB)
MD5 2f6e2354a8ee6fb403f747ce8d42a9e0
SHA1 0fb58c5e285bd59e5492a597d771b5c5e018fcb6
SHA256 89f5ab08db492e68a4fd261585ca42a03babc08eaec495e1ad8af47f96faa4b1
IMPHASH E497CBA696E77737A45672336BFDD193
PE timestamp 2023-08-01 02:53:20Z
Signed
Authenticode Signer name Microsoft Corporation
Root CA name Microsoft Root Certificate Authority 2011
Company name Microsoft Corporation
File Description Microsoft Outlook
File version 16.0.10401.20025
Internal name Outlook
Product name Microsoft Outlook
Product version 16.0.10401.20025

target_filename C:\Users\xxxxxxx\AppData\Local\Microsoft\Windows\SchCache\xxxx.home.sch

Description

I get from times to times false positive with outlook.exe .
Perhaps we shoud add it to the whitelist?

[nekopep]

Got another one for another domain with Image name :
C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
(please note (x86) difference)

[nasbench]

Thanks for the submission. This indeed looks like an FP.

The severity also looks a little higher than it should be. Will apply the necessary filters :)

Cheers.