huntrule

Suspicious Windows Program Execution from Outlook Temporary Internet Files Folder

Alerts on process executions whose image path points to Outlook temporary files (Content.Outlook).

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2019-10-01
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Initial Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation events where the executed image path contains the Outlook temporary internet files location (\Temporary Internet Files\Content.Outlook\). Attackers may use this writable temporary directory to stage or run payloads under the context of an email-related workflow. It relies on Windows process creation telemetry, specifically the Image path field for the spawned process.

Reporting behind it

Related detections9 linkedT1566.001 — drag to rearrange
Suspicious mstsc Launch of RDP File From User Download or Temp Path (via process_creation)
Suspicious Regsvr32 Squiblydoo Remote Scriptlet Execution via Command Line (via process_creation)
Possible Mamba 2FA AiTM Phishing URL Pattern
Suspicious DLL Written to Explorer IconCache Path
Suspicious DNS Query to HTML Smuggling AiTM Phishing Domain
Malicious Microsoft Word Spawning Anomalous Child Process via CVE-2023-36884 (via process_creation)
Malicious Equation Editor Child Process Execution via process_creation
Microsoft 365 inbound suspicious email delivered to Inbox or Junk
Web Browser Opens .HTM/.HTML from Downloads Folder on Windows
Suspicious Windows Program Execution from Outlook Temporary Internet Files Folder
Pivot detection · T1566.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.