Code Injection from Outlook and Excel

Question

Hi All,

We have observed Outlook and Excel attempted code injection by calling the function "SetWindowsHookExW," resulting in blocks by Carbon Black endpoint protection.

We would like to understand if this behavior is expected and why these applications are attempting code injection.

Alerts:

Outlook: The application "c:\program files\microsoft office\root\office16\outlook.exe" attempted to inject code into the process "c:\program files\microsoft office\root\office16\outlook.exe" by calling the function "SetWindowsHookExW." The operation was blocked by Carbon Black.

Excel: The script "\desktop\file\B_list.xlsx" attempted to inject code into the process "c:\program files\microsoft office\root\office16\excel.exe" by calling the function "SetWindowsHookExW." The operation was blocked by Carbon Black.

Thank you.