* Replaced unspecified logsource attribute 'type' with 'category' * Usage of service 'auth' for linux logs
https://www.crowdstrike.com/blog/using-outlook-forms-lateral-movement-persistence/