Detectionhightest

Outlook EnableUnsafeClientMailRules Setting Enabled

Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Markus Neis, Nasreddine Bencherchali (Nextron Systems)Created Thu Dec 27Updated Thu Feb 0955f0a3a1-846e-40eb-8273-677371b8d912windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        CommandLine|contains: '\Outlook\Security\EnableUnsafeClientMailRules'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

support.microsoft.com

MITRE ATT&CK

Tactics

TA0002 · Execution TA0005 · Defense Evasion

Techniques

T1059 · Command and Scripting Interpreter T1202 · Indirect Command Execution

Related Rules

SimilarDetectionhigh

Outlook EnableUnsafeClientMailRules Setting Enabled - Registry

Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

55f0a3a1-846e-40eb-8273-677371b8d912

Status

test

Level

high

Type

Detection

Created

Thu Dec 27

Modified

Thu Feb 09

Author

Markus Neis, Nasreddine Bencherchali (Nextron Systems)

Path

rules/windows/process_creation/proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.yml

Raw Tags

attack.executionattack.defense-evasionattack.t1059attack.t1202

View on GitHub