Suspicious File Created in Outlook Temporary Directory (via file_event)

This rule detects the creation of files with anomalous file extensions in the temporary directory that Outlook uses when opening attachments. This can be leveraged to detect spear-phishing campaigns that use anomalous files as attachments, which may contain hostile code.