New Outlook Macro Created

Severity: medium
Author: @ScoubiMtl
Source: upstream

Detects the creation of a macro file for Outlook.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1137` Office Application Startup, `T1546` Event Triggered Execution
Privilege Escalation	`T1546` Event Triggered Execution
Command & Control	`T1008` Fallback Channels

Event coverage

Provider	Event ID	Title
Sysmon	11	FileCreate

Stages and Predicates

Stage 1: `selection`

Image|endswith: '\outlook.exe'
TargetFilename|endswith: '\Microsoft\Outlook\VbaProject.OTM'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`Image`	ends_with	`\outlook.exe` corpus 16 (sigma 16)
`TargetFilename`	ends_with	`\Microsoft\Outlook\VbaProject.OTM` corpus 2 (sigma 2)

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.

Suspicious Outlook Macro Created [sigma] (drops 1 filter this rule applies) (first-stage match only; downstream stages may differ)