Detectionhightest
Potential Persistence Via Outlook Form
Detects the creation of a new Outlook form which can contain malicious code
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsFile Event
ProductWindows← raw: windows
CategoryFile Event← raw: file_event
Events for file system activity including creation, modification, and deletion.
Detection Logic
Detection Logic1 selector
detection:
selection:
Image|endswith: '\outlook.exe'
TargetFilename|contains:
- '\AppData\Local\Microsoft\FORMS\IPM'
- '\Local Settings\Application Data\Microsoft\Forms' # Windows XP
condition: selectionFalse Positives
Legitimate use of outlook forms
MITRE ATT&CK
Tactics
Sub-techniques
Rule Metadata
Rule ID
c3edc6a5-d9d4-48d8-930e-aab518390917
Status
test
Level
high
Type
Detection
Created
Thu Jun 10
Modified
Wed Feb 22
Author
Path
rules/windows/file/file_event/file_event_win_office_outlook_newform.yml
Raw Tags
attack.persistenceattack.t1137.003