T1137 - Outlook VbaProject.OTM Persistence File Created (Target: ) · win.eventdata.targetFilename = (?i)\\\\Microsoft\\\\Outlook\\\\VbaProject\.OTM
Description
T1137 - Outlook VbaProject.OTM Persistence File Created (Target: $(win.eventdata.targetFilename))
Query · wazuh
field win.eventdata.targetFilename="(?i)\\\\Microsoft\\\\Outlook\\\\VbaProject\.OTM$"
No license declared
socfortress/Wazuh-Rules publishes no license, and without an express grant the default is all rights reserved. The query above is synthesized from the rule rather than copied out of it, so you can see what the rule matches on; the rule as written stays upstream.
Read the full rule at Windows_Sysmon/110101-MITRE_TECHNIQUES_FROM_SYSMON_EVENT11.xml ↗. Why this rule is treated this way.
Rule dependencies
Depends on
-
composes · Wazuh if_group
sysmon_event_11- Sysmon - Event 11: FileCreate by · system.eventID = 11
- Sysmon - Event 11: FileCreate by · eventdata.image = wazuh-agentd
- Sysmon - Event 11
- Sysmon - Event 11: FileCreate by · Application Shimming (T1546.011)
- Sysmon - Event 11: FileCreate by · Scripting (T1064)
- Sysmon - Event 11: FileCreate by · Office Signed Binary Proxy Execution (T1218)
- Sysmon - Event 11: FileCreate by · Mshta (T1218.005)
- Sysmon - Event 11: FileCreate by · Forced Authentication (T1187)
- Sysmon - Event 11: FileCreate by · Trusted Developer Utilities Proxy Execution (T1127)
- Sysmon - Event 11: FileCreate by · PowerShell (T1059.001)
- Sysmon - Event 11: FileCreate by · File System Permissions Weakness (T1044)
- Sysmon - Event 11: FileCreate by · File System Permissions Weakness (T1047)
- Sysmon - Event 11: FileCreate by · Windows Management Instrumentation (T1047)
- Sysmon - Event 11: FileCreate by · Services File Permissions Weakness (T1546.008)
- The file has been created. Possible ransomware activity. · win.eventdata.targetFilename = (?i)\\\\users, win.eventdata.targetFilename = (?i)\.+readme\.txt
- MITRE ATTaCK T1542.001 Pre-OS Boot: System Firmware - wpbbin.exe file created in System32. Possible firmware persistence attempt.
- Possible mailbox data manipulation detected (T1070.008 - Email Collection: Mailbox Manipulation)
- T1546.013 - PowerShell Profile modified: Potential persistence mechanism detected (Event Triggered Execution)
- T1547.012 - DLL Dropped in Print Processors Directory (TargetFilename: ) · win.eventdata.targetFilename = (?i)C:\\\\Windows\\\\System32\\\\spool\\\\prtprocs\\\\x64\\…
- Sysmon - Event 11: FileCreate by · win.system.eventID = 11