Office Application Startup: Outlook Rules T1137.005

Tactic: Persistence

Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system. Outlook rules allow a user to define automated behavior to manage email messages. A benign rule might, for example, automatically move an email to a particular folder in Outlook if it contains specific words from a specific sender. Malicious Outlook rules can be created that can trigger code execution when an adversary sends a specifically crafted email to that user.

Authoring guide

These 3 rules share fields, values, and exclusions.

Fields filtered most (12 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
EventType2in 2new-inboxrule, set-inboxrule
data_stream.dataset2eq 2o365.audit
event.outcome2eq 2success
Esql.inbox_rule_name1regex_match 1[!@#$%^&*()_+={[\]|\\:;"'<,>.?/~` \-]+
Provider_Name1eq 1exchange
m365::ObjectId1is_not_null 1
o365.audit.Parameters.BodyContainsWords1eq 1\u0000
o365.audit.Parameters.DeleteMessage1eq 1true
o365.audit.Parameters.MoveToFolder1contains 1calendar, deleted, junk
o365.audit.Parameters.SubjectContainsWords1contains 1alert, fraud, hack
o365.audit.Parameters.WithinSizeRangeMinimum1le 11023
operation1in 1New-InboxRule, Set-Mailbox

Top indicator values (30 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
EventTypein
new-inboxrule
22
EventTypein
set-inboxrule
22
data_stream.dataseteq
o365.audit
247
event.outcomeeq
success
2375
Esql.inbox_rule_nameregex_match
[!@#$%^&*()_+={[\]|\\:;"'<,>.?/~` \-]+
1
Provider_Nameeq
exchange
117
o365.audit.Parameters.BodyContainsWordseq
\u0000
1
o365.audit.Parameters.DeleteMessageeq
true
1
o365.audit.Parameters.MoveToFoldercontains
calendar
1
o365.audit.Parameters.MoveToFoldercontains
deleted
1
o365.audit.Parameters.MoveToFoldercontains
junk
1
o365.audit.Parameters.MoveToFoldercontains
rss
1
o365.audit.Parameters.SubjectContainsWordscontains
alert
1
o365.audit.Parameters.SubjectContainsWordscontains
fraud
1
o365.audit.Parameters.SubjectContainsWordscontains
hack
1
o365.audit.Parameters.SubjectContainsWordscontains
invoice
1
o365.audit.Parameters.SubjectContainsWordscontains
login
1
o365.audit.Parameters.SubjectContainsWordscontains
malware
1
o365.audit.Parameters.SubjectContainsWordscontains
payment
1
o365.audit.Parameters.SubjectContainsWordscontains
phish
1
o365.audit.Parameters.SubjectContainsWordscontains
protection
1
o365.audit.Parameters.SubjectContainsWordscontains
reset
1
o365.audit.Parameters.SubjectContainsWordscontains
security
1
o365.audit.Parameters.SubjectContainsWordscontains
suspicious
1
o365.audit.Parameters.SubjectContainsWordscontains
transfer
1
o365.audit.Parameters.SubjectContainsWordscontains
unusual
1
o365.audit.Parameters.SubjectContainsWordscontains
wire
1
o365.audit.Parameters.WithinSizeRangeMinimumle
1023
1
operationin
New-InboxRule
1
operationin
Set-Mailbox
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Microsoft 365

Domain (all)

Elastic 2 rules

Panther 1 rule