Sigma rule: Potential Persistence Via Outlook Form

Rule

Title

Potential Persistence Via Outlook Form

Status

test

Level

high

Author

Tobias Michalski (Nextron Systems)

Date

2021-06-10

Modified

2023-02-22

File

rules/windows/file/file_event/file_event_win_office_outlook_newform.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of a new Outlook form which can contain malicious code

Log source

product

windows

category

file_event

Detection

selection:
    Image|endswith: '\outlook.exe'
    TargetFilename|contains:
        - '\AppData\Local\Microsoft\FORMS\IPM'
        - '\Local Settings\Application Data\Microsoft\Forms' # Windows XP
condition: selection

False positives (as the rule lists them)

• Legitimate use of outlook forms

Tags

• attack.persistence
• attack.t1137.003

MITRE ATT&CK ids this rule names

• T1137.003

References

• https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=76
• https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=79
• https://learn.microsoft.com/en-us/office/vba/outlook/concepts/outlook-forms/create-an-outlook-form
• https://www.slipstick.com/developer/custom-form/clean-outlooks-forms-cache/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_office_outlook_newform.yml