CVE-2026-124194: Outlook 'Missing User Interaction' Vulnerability Under Active Exploitation — Detection and Remediation Guide

---
title: Outlook Spawning Suspicious Child Process (Possible CVE-2026-124194 Exploitation)
id: 8c2e4f61-3b7a-4d29-9e15-6a1c9d4e2f07
status: experimental
description: Detects OUTLOOK.EXE spawning script interpreters, shells, or LOLBins — behavior consistent with post-exploitation following a no-user-interaction Outlook exploit such as CVE-2026-124194.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-124194
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\OUTLOOK.EXE'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\msiexec.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare — some CRM or add-in integrations may shell out; investigate any hit rather than blanket-excluding
level: high
---
title: Office Process Writing Executable or Script Content to User Directories
id: 2f7a9c34-6e1d-4b85-a392-5d8e1f6c0a43
status: experimental
description: Detects Outlook or other Office processes dropping executables, scripts, or DLLs into user-writable staging directories — consistent with second-stage payload delivery after exploitation of an email-borne Office flaw such as CVE-2026-124194.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-124194
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\OUTLOOK.EXE'
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\POWERPNT.EXE'
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\ProgramData\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.bat'
      - '.cmd'
      - '.vbs'
      - '.js'
      - '.hta'
      - '.scr'
  condition: selection_image and selection_path and selection_ext
falsepositives:
  - Legitimate Office add-in updates (typically signed and in predictable vendor paths — exclude per-vendor, not per-extension)
level: high
---
title: Outlook Outbound Connection to Rare External Destination
id: 5b1d8e90-4c3f-47a6-b218-9e6d2a5c7f18
status: experimental
description: Detects OUTLOOK.EXE establishing outbound connections to non-mail-server destinations on uncommon ports. Exploitation chains for no-click Outlook vulnerabilities often beacon or retrieve payloads from attacker infrastructure distinct from Exchange/Microsoft 365 endpoints.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-124194
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: '\OUTLOOK.EXE'
    Initiated: 'true'
  filter_ports:
    DestinationPort:
      - 25
      - 80
      - 443
      - 587
      - 993
      - 995
  filter_m365:
    DestinationHostname|endswith:
      - '.outlook.com'
      - '.office365.com'
      - '.microsoftonline.com'
      - '.outlook.office.com'
  condition: selection and not 1 of filter_*
falsepositives:
  - Environments with on-premises Exchange or third-party mail gateways — add those hostnames/IPs to the filter
level: medium

let lookback = 14d;
let suspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","msiexec.exe","wmic.exe","curl.exe"]);
let outlookSpawn =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where InitiatingProcessFileName =~ "OUTLOOK.EXE"
    | where FileName in~ (suspiciousChildren)
    | project DeviceId, DeviceName, SpawnTime=TimeGenerated, ChildProcess=FileName, ChildCmd=ProcessCommandLine, AccountName, InitiatingProcessCommandLine;
let officeNet =
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where InitiatingProcessFileName =~ "OUTLOOK.EXE"
    | where RemotePort !in (25, 80, 443, 587, 993, 995)
    | where RemoteUrl !endswith "outlook.com" and RemoteUrl !endswith "office365.com" and RemoteUrl !endswith "microsoftonline.com"
    | project DeviceId, NetTime=TimeGenerated, RemoteUrl, RemoteIP, RemotePort;
outlookSpawn
| join kind=leftouter officeNet on DeviceId
| extend NetWithinWindow = iff(isnotempty(NetTime) and NetTime between (SpawnTime .. SpawnTime + 30m), "Yes", "No")
| project DeviceName, AccountName, SpawnTime, ChildProcess, ChildCmd, RemoteUrl, RemoteIP, RemotePort, NetWithinWindow
| order by SpawnTime desc;

-- CVE-2026-124194 hunt: Outlook spawning suspicious child processes
-- Scope fleet-wide; any hit warrants immediate triage of the endpoint and mailbox
LET suspicious_children = ('cmd.exe', 'powershell.exe', 'pwsh.exe', 'wscript.exe',
                           'cscript.exe', 'mshta.exe', 'rundll32.exe', 'regsvr32.exe',
                           'certutil.exe', 'bitsadmin.exe', 'msiexec.exe', 'wmic.exe', 'curl.exe')

SELECT Pid,
       Ppid,
       Name AS ChildProcess,
       CommandLine AS ChildCommandLine,
       Exe AS ChildPath,
       Username,
       CreateTime AS ProcessStartTime
FROM pslist()
WHERE Name =~ '(?i)^(' + join(array=suspicious_children, sep='|') + ')$'
  AND Ppid IN (
        SELECT Pid FROM pslist()
        WHERE Name =~ '(?i)OUTLOOK\.EXE$'
      )

# CVE-2026-124194 - Outlook exposure inventory and update verification
# Run as SYSTEM/Administrator via RMM, Intune, or SCCM

$report = [ordered]@{}

# 1. Detect installed Office Click-to-Run version
$c2rPath = 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration'
if (Test-Path $c2rPath) {
    $c2r = Get-ItemProperty -Path $c2rPath
    $report['OfficeVersion']      = $c2r.VersionToReport
    $report['UpdateChannel']      = $c2r.UpdateChannel
    $report['UpdatesEnabled']     = $c2r.UpdatesEnabled
} else {
    # MSI-based Office fallback
    $report['OfficeVersion'] = 'MSI-based or not detected - check registry uninstall keys'
}

# 2. Confirm Outlook is present
$outlookExe = Get-ChildItem -Path "$env:ProgramFiles\Microsoft Office","${env:ProgramFiles(x86)}\Microsoft Office" `
    -Filter 'OUTLOOK.EXE' -Recurse -ErrorAction SilentlyContinue | Select-Object -First 1
$report['OutlookInstalled'] = [bool]$outlookExe
$report['OutlookPath']      = $outlookExe.FullName

# 3. Check pending Office updates
$pendingPath = 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Updates'
$report['PendingUpdate'] = (Test-Path $pendingPath)

# 4. Force an Office update check (Click-to-Run)
$officeC2RClient = "$env:ProgramFiles\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe"
if (Test-Path $officeC2RClient) {
    Start-Process -FilePath $officeC2RClient -ArgumentList '/update user displaylevel=false forceappshutdown=true' -Wait -NoNewWindow
    $report['UpdateTriggered'] = $true
} else {
    $report['UpdateTriggered'] = $false
}

# 5. Hardening check: verify Protected View / attachment and preview hardening registry keys
$secKey = 'HKCU:\Software\Microsoft\Office\16.0\Outlook\Security'
if (Test-Path $secKey) {
    $report['OutlookSecurityKeys'] = Get-ItemProperty -Path $secKey | Out-String
}

$report | Format-List