Office Application Startup: Outlook Rules T1137.005

Tactic: Persistence

Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system. Outlook rules allow a user to define automated behavior to manage email messages. A benign rule might, for example, automatically move an email to a particular folder in Outlook if it contains specific words from a specific sender. Malicious Outlook rules can be created that can trigger code execution when an adversary sends a specifically crafted email to that user.

Authoring guide

Patterns shared across the 3 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (12 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
EventType2in 2New-InboxRule, Set-InboxRule
data_stream.dataset2eq 2o365.audit
event.outcome2eq 2success
Esql.inbox_rule_name1regex_match 1[!@#$%^&*()_+={[\]|\\:;"'<,>.?/~` \-]+
Provider_Name1eq 1Exchange
m365::ObjectId1is_not_null 1
o365.audit.Parameters.BodyContainsWords1eq 1\u0000
o365.audit.Parameters.DeleteMessage1eq 1True
o365.audit.Parameters.MoveToFolder1contains 1calendar, deleted, junk
o365.audit.Parameters.SubjectContainsWords1contains 1alert, fraud, hack
o365.audit.Parameters.WithinSizeRangeMinimum1le 11023
operation1in 1New-InboxRule, Set-Mailbox

Top indicator values (30 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
EventTypein
New-InboxRule
23
EventTypein
Set-InboxRule
23
data_stream.dataseteq
o365.audit
245
event.outcomeeq
success
2251
Esql.inbox_rule_nameregex_match
[!@#$%^&*()_+={[\]|\\:;"'<,>.?/~` \-]+
1
Provider_Nameeq
Exchange
119
o365.audit.Parameters.BodyContainsWordseq
\u0000
1
o365.audit.Parameters.DeleteMessageeq
True
1
o365.audit.Parameters.MoveToFoldercontains
calendar
1
o365.audit.Parameters.MoveToFoldercontains
deleted
1
o365.audit.Parameters.MoveToFoldercontains
junk
1
o365.audit.Parameters.MoveToFoldercontains
rss
1
o365.audit.Parameters.SubjectContainsWordscontains
alert
1
o365.audit.Parameters.SubjectContainsWordscontains
fraud
1
o365.audit.Parameters.SubjectContainsWordscontains
hack
1
o365.audit.Parameters.SubjectContainsWordscontains
invoice
1
o365.audit.Parameters.SubjectContainsWordscontains
login
1
o365.audit.Parameters.SubjectContainsWordscontains
malware
1
o365.audit.Parameters.SubjectContainsWordscontains
payment
1
o365.audit.Parameters.SubjectContainsWordscontains
phish
1
o365.audit.Parameters.SubjectContainsWordscontains
protection
1
o365.audit.Parameters.SubjectContainsWordscontains
reset
1
o365.audit.Parameters.SubjectContainsWordscontains
security
1
o365.audit.Parameters.SubjectContainsWordscontains
suspicious
1
o365.audit.Parameters.SubjectContainsWordscontains
transfer
1
o365.audit.Parameters.SubjectContainsWordscontains
unusual
1
o365.audit.Parameters.SubjectContainsWordscontains
wire
1
o365.audit.Parameters.WithinSizeRangeMinimumle
1023
1
operationin
New-InboxRule
1
operationin
Set-Mailbox
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Elastic 2 rules

Panther 1 rule