Corruption behaviors are usually happened in outsourcing cases and always affect the profit and damage the image of an organization. Thus, stop corruption behaviors from happening throughout grasping and detecting abnormal behavior pattern would be helpful. However, the patterns of abnormal behavior are always hard to be analyzed because those behaviors should be quantified in a higher dimensional space and they are sometimes correlated each other. In this research Maholanobis Distance (MD) and Decision Tree (DT) are integrated for abnormal behavior pattern analysis. Based on the data of all cases, the MDs of all case can be calculated. Then all cases are categorized by their MDs. Any case whose MD is higher than a threshold is labeled by abnormal while the remaining are labeled by normal. After oversampling on the minority class of abnormal, a DT is built by Classification and Regression Trees (CART) based on the labeled dataset. Finally, the combinations of criteria for abnormal categories are extracted from the tree. A case of maintenance outsourcing process from a conglomerate was introduced for testing. The results show that the combinations of criteria generated by the proposed methodology can provide more exact direction for investigation of corruption behavior.