Outlook Process Loads outlvba.dll (Microsoft VBA Add-in) on Windows

Alerts on outlvba.dll being loaded by outlook.exe, indicating VBA add-in execution within Outlook.

FreeUnreviewedSigmamediumv1

outlook-process-loads-outlvba-dll-microsoft-vba-add-in-on-windows-9a0b8719

title: Outlook Process Loads outlvba.dll (Microsoft VBA Add-in) on Windows
id: 5cac07bb-d4ed-4112-a653-2b49d627aa23
status: test
description: This rule flags when the Outlook process loads outlvba.dll, a Microsoft VBA for Outlook add-in component. Attackers may leverage Outlook and VBA functionality to support execution, persistence, or malicious automation within a user context. The detection relies on image load telemetry indicating the loaded DLL path and the owning process image name on Windows.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=58
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_office_outlook_outlvba_load.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-08
modified: 2024-03-12
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \outlook.exe
    ImageLoaded|endswith: \outlvba.dll
  condition: selection
falsepositives:
  - Legitimate macro usage. Add the appropriate filter according to your environment
level: medium
license: DRL-1.1
related:
  - id: 9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed
    type: derived

What it detects

This rule flags when the Outlook process loads outlvba.dll, a Microsoft VBA for Outlook add-in component. Attackers may leverage Outlook and VBA functionality to support execution, persistence, or malicious automation within a user context. The detection relies on image load telemetry indicating the loaded DLL path and the owning process image name on Windows.

Known false positives

Legitimate macro usage. Add the appropriate filter according to your environment

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.