Suspicious Windows Program Execution from Outlook Temporary Internet Files Folder

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1566.001Spearphishing Attachment
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where the executed image path contains the Outlook temporary internet files location (\Temporary Internet Files\Content.Outlook\). Attackers may use this writable temporary directory to stage or run payloads under the context of an email-related workflow. It relies on Windows process creation telemetry, specifically the Image path field for the spawned process.

Reporting behind it

Related detections9 linkedT1566.001 — drag to rearrange

Suspicious mstsc Launch of RDP File From User Download or Temp Path (via process_creation)

Suspicious Regsvr32 Squiblydoo Remote Scriptlet Execution via Command Line (via process_creation)

Possible Mamba 2FA AiTM Phishing URL Pattern

Suspicious DLL Written to Explorer IconCache Path

Suspicious DNS Query to HTML Smuggling AiTM Phishing Domain

Malicious Microsoft Word Spawning Anomalous Child Process via CVE-2023-36884 (via process_creation)

Malicious Equation Editor Child Process Execution via process_creation

Microsoft 365 inbound suspicious email delivered to Inbox or Junk

Web Browser Opens .HTM/.HTML from Downloads Folder on Windows

Suspicious Windows Program Execution from Outlook Temporary Internet Files Folder

Pivot detection · T1566.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

suspicious-windows-program-execution-from-outlook-temporary-internet-files-folde-a018fdc3

title: Suspicious Windows Program Execution from Outlook Temporary Internet Files Folder
id: 73974389-56ef-4ad9-87ea-c216a4f00de9
status: test
description: This rule flags process creation events where the executed image path contains the Outlook temporary internet files location (\Temporary Internet Files\Content.Outlook\). Attackers may use this writable temporary directory to stage or run payloads under the context of an email-related workflow. It relies on Windows process creation telemetry, specifically the Image path field for the spawned process.
author: Florian Roth (Nextron Systems), Huntrule Team
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_outlook_execution_from_temp.yml
date: 2019-10-01
modified: 2022-10-09
tags:
  - attack.initial-access
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains: \Temporary Internet Files\Content.Outlook\
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a018fdc3-46a3-44e5-9afb-2cd4af1d4b39
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL