LoFP LoFP / t1137

t1137

TitleTags
a legitimate vba for outlook is usually configured interactively via outlook.exe.
administrative activity
because this file are always created by outlook in normal operations, you should investigate all results.
it is unusual to modify this feature on a windows system since it is a default security control, although it is not rare for some policies to disable it. although no false positives have been identified, use the provided filter macro to tune the search.
it is unusual to modify this feature on a windows system. although no false positives have been identified, use the provided filter macro to tune the search.
legitimate add-ins
legitimate addin installation
legitimate use of outlook forms
loading a user environment from a backup or a domain controller
synchronization of templates
unknown
unlikely
user genuinely creates a vb macro for their email