Suspicious Microsoft VBA For Outlook Addin Loaded Through Outlook (via image_load)

title: Suspicious Microsoft VBA For Outlook Addin Loaded Through Outlook (via image_load)
id: fb6f4f59-4617-5252-a550-70ba08b10938
status: stable
description: This rule detects outlvba (Microsoft VBA for Outlook Addin) DLL being loaded by the outlook process
references:
    - https://attack.mitre.org/techniques/T1204/002/
    - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=58
author: Huntrule Team
date: 2026-03-13
tags:
    - attack.execution
    - attack.t1204.002
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\outlook.exe'
        ImageLoaded|endswith: '\outlvba.dll'
    condition: selection
falsepositives:
    - Unknown
level: medium