Cross-source coverage
T1137.005 / ATT&CK
Office Application Startup: Outlook Rules
3 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system. Outlook rules allow a user to define automated behavior to manage email messages. A benign rule might, for example, automatically move an email to a particular folder in Outlook if it contains specific words from a specific sender. Malicious Outlook rules can be created that can trigger code execution when an adversary sends a specifically crafted email to that user.
Once malicious rules have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious rules will execute when an adversary sends a specifically crafted email to the user.
- Tactics
- Persistence
- Platforms
- Windows · Office Suite
- Telemetry
-
WinEventLog:SysmonWinEventLog:ApplicationWinEventLog:PowerShellm365:unifiedm365:messagetrace
How MITRE says to detect it DET0095
Detect Persistence via Malicious Outlook Rules
Windows Analytic 0263
Adversary uses a tool like Ruler or MFCMapi to create a malicious Outlook rule that triggers execution upon receipt of a crafted email. On email delivery, Outlook executes the rule, resulting in code execution (e.g., launching mshta.exe or PowerShell). Outlook spawns a non-standard child process, often unsanctioned, without user interaction.
WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=7WinEventLog:ApplicationOutlook rule execution failure or abnormal rule execution contextWinEventLog:PowerShellPowerShell launched from outlook.exe or triggered without user invocation
Office Suite Analytic 0264
Adversary adds a new Outlook rule with modified or obfuscated PR_RULE_MSG_NAME and PR_RULE_MSG_PROVIDER attributes using MFCMapi or Ruler. Rule is triggered when email arrives, executing embedded or external code. Mailbox audit logs or Unified Audit Log shows automated rule-triggered action without user interaction.
m365:unifiedCreation or modification of inbox rule outside of normal user behaviorm365:messagetraceInbound email matches crafted rule trigger pattern tied to persistence logic
elastic/detection-rules
2 rules| Detection | Severity | Format |
|---|---|---|
| M365 Exchange Inbox Phishing Evasion Rule Created | High | Elastic TOML |
| M365 Exchange Inbox Rule with Obfuscated Name | Medium | Elastic TOML |
panther-labs/panther-analysis
1 rule| Detection | Severity | Format |
|---|---|---|
| Microsoft Exchange External Forwarding | High | Panther Python |