detection.wiki

Detection rules › Sigma

Suspicious File Created in Outlook Temporary Directory

Status
experimental
Severity
high
Log source
product windows, category file_event
Author
Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening attachments. This can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code.

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1566.001 Phishing: Spearphishing Attachment

Event coverage

ProviderEventTitle
SysmonEvent ID 11FileCreate

Rule body yaml

title: Suspicious File Created in Outlook Temporary Directory
id: fabb0e80-030c-4e3e-a104-d09676991ac3
related:
    - id: f748c45a-f8d3-4e6f-b617-fe176f695b8f
      type: obsolete
status: experimental
description: |
    Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening attachments.
    This can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code.
references:
    - https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/
    - https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/
    - https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/
author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-07-22
tags:
    - attack.initial-access
    - attack.t1566.001
logsource:
    product: windows
    category: file_event
detection:
    selection_extension:
        TargetFilename|endswith:
            - '.cpl'
            - '.hta'
            - '.iso'
            - '.rdp'
            - '.svg'
            - '.vba'
            - '.vbe'
            - '.vbs'
    selection_location:
        - TargetFilename|contains:
              - '\AppData\Local\Packages\Microsoft.Outlook_'
              - '\AppData\Local\Microsoft\Olk\Attachments\'
        - TargetFilename|contains|all:
              - '\AppData\Local\Microsoft\Windows\'
              - '\Content.Outlook\'
    condition: all of selection_*
falsepositives:
    - Opening of headers or footers in email signatures that include SVG images or legitimate SVG attachments
level: high

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_extension

selection_extension:
    TargetFilename|endswith:
        - '.cpl'
        - '.hta'
        - '.iso'
        - '.rdp'
        - '.svg'
        - '.vba'
        - '.vbe'
        - '.vbs'

Stage 2: selection_location

selection_location:
    - TargetFilename|contains:
          - '\AppData\Local\Packages\Microsoft.Outlook_'
          - '\AppData\Local\Microsoft\Olk\Attachments\'
    - TargetFilename|contains|all:
          - '\AppData\Local\Microsoft\Windows\'
          - '\Content.Outlook\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetFilenameends_with
  • .cpl corpus 2 (sigma 2)
  • .hta corpus 13 (sigma 13)
  • .iso corpus 5 (sigma 5)
  • .rdp corpus 2 (sigma 2)
  • .svg corpus 2 (sigma 2)
  • .vba corpus 3 (sigma 3)
  • .vbe corpus 15 (sigma 15)
  • .vbs corpus 18 (sigma 18)
TargetFilenamematch
  • \AppData\Local\Microsoft\Olk\Attachments\
  • \AppData\Local\Microsoft\Windows\
  • \AppData\Local\Packages\Microsoft.Outlook_
  • \Content.Outlook\