unexpected mapi32.dll access

We recently started shipping all of our EDR data to our SIEM, and we started getting alerts to 'possible emotet' activity.

The alert specifically looks for non-outlook processes loading mapi32.dll. Simple, but has never been triggered because we didn't have process data in the SIEM yet.

I was able to find a [good resource](https://www.seqrite.com/documents/en/white-papers/Whitepaper_HowToPM.pdf) describing how emotet uses mapi32.dll to scrape local email data

\-------

Upon shipping the data, we immediately had this rule trigger hundreds of times. Which can …

access acrobat alert alerts computerforensics data dll edr emotet excel false positive non outlook process processes question shipping siem simple trigger