huntrule

Suspicious Windows Program Execution from Outlook Temporary Internet Files Folder

Alerts on process executions whose image path points to Outlook temporary files (Content.Outlook).

FreeUnreviewedSigmahighv1
title: Suspicious Windows Program Execution from Outlook Temporary Internet Files Folder
id: 73974389-56ef-4ad9-87ea-c216a4f00de9
status: test
description: This rule flags process creation events where the executed image path contains the Outlook temporary internet files location (\Temporary Internet Files\Content.Outlook\). Attackers may use this writable temporary directory to stage or run payloads under the context of an email-related workflow. It relies on Windows process creation telemetry, specifically the Image path field for the spawned process.
author: Florian Roth (Nextron Systems), Huntrule Team
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_outlook_execution_from_temp.yml
date: 2019-10-01
modified: 2022-10-09
tags:
  - attack.initial-access
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains: \Temporary Internet Files\Content.Outlook\
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a018fdc3-46a3-44e5-9afb-2cd4af1d4b39
    type: derived

What it detects

This rule flags process creation events where the executed image path contains the Outlook temporary internet files location (\Temporary Internet Files\Content.Outlook\). Attackers may use this writable temporary directory to stage or run payloads under the context of an email-related workflow. It relies on Windows process creation telemetry, specifically the Image path field for the spawned process.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.