Detectionmediumtest

Microsoft VBA For Outlook Addin Loaded Via Outlook

Detects outlvba (Microsoft VBA for Outlook Addin) DLL being loaded by the outlook process

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems)Created Wed Feb 08Updated Tue Mar 129a0b8719-cd3c-4f0a-90de-765a4cb3f5edwindows

Log Source

WindowsImage Load (DLL)

ProductWindows← raw: windows

CategoryImage Load (DLL)← raw: image_load

Detection Logic

detection:
    selection:
        Image|endswith: '\outlook.exe'
        ImageLoaded|endswith: '\outlvba.dll'
    condition: selection

False Positives

Legitimate macro usage. Add the appropriate filter according to your environment

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed

Status

test

Level

medium

Type

Detection

Created

Wed Feb 08

Modified

Tue Mar 12

Author

Path

rules/windows/image_load/image_load_office_outlook_outlvba_load.yml

Raw Tags

attack.executionattack.t1204.002