Suspicious Creation of New Outlook Macro (via file_event)

title: Suspicious Creation of New Outlook Macro (via file_event)
id: 9ae9597a-8d1e-5c87-a4a5-be5e6930b71b
status: stable
description: This rule detects the creation of a macro file for Outlook.
references:
    - https://attack.mitre.org/techniques/T1546/
    - https://attack.mitre.org/techniques/T1008/
    - https://attack.mitre.org/techniques/T1137/
    - https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/
author: 'Huntrule Team'
date: 2026-03-23
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.command-and-control
    - attack.t1137
    - attack.t1008
    - attack.t1546
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\outlook.exe'
        TargetFilename|endswith: '\Microsoft\Outlook\VbaProject.OTM'
    condition: selection
falsepositives:
    - Unknown
level: medium