Windows: Suspicious Outlook VbaProject.OTM Macro File Created

High-confidence file creation alert for Microsoft\Outlook\VbaProject.OTM while excluding outlook.exe.

FreeReviewedSigma · High · v2

Product: windows
Category: file_event
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-02-08
Updated: 2026-07-31

ATT&CK techniques

Persistence → C2

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1137Office Application Startup
- T1546Event Triggered Execution
Priv Esc
- T1546Event Triggered Execution
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1008Fallback Channels
Exfiltration
Impact

What it detects

This rule identifies creation of a macro document at a specific Outlook VBA project path ending with \Microsoft\Outlook\VbaProject.OTM. Attackers may use Outlook macro content as a persistence mechanism to execute VBA when Outlook processes or uses the stored project. It relies on Windows file creation telemetry, matching the target filename and excluding events where outlook.exe is the creating process.

Reporting behind it

Related detections9 linkedT1546 — drag to rearrange

Windows Persistence: Outlook LoadMacroProviderOnBoot Registry Setting Modification

Windows: New Outlook VBAProject OTM Macro File Created

Windows Registry: Outlook Macro Security Level Set to Enable All Macros

Suspicious Python Path Configuration Hook Persistence (via file_event)

Suspicious Zsh Persistence via zshrc_aliases Appended to Shell Startup (via process_creation)

Malicious UNC4841 Dropper Deployment to Boot Partition via mknod (via process_creation)

Suspicious NetworkManager Dispatcher Script Persistence

Suspicious APT Or YUM Package Manager Hook Configuration Created

Suspicious Office Application Spawning Mshta With Remote HTA

Windows: Suspicious Outlook VbaProject.OTM Macro File Created

Pivot detection · T1546 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-alert-on-creation-of-outlook-vbaproject-otm-macro-file-117d3d3a

title: "Windows: Suspicious Outlook VbaProject.OTM Macro File Created"
id: 34de11c8-eb14-4669-af2d-03c1cd19b3c4
related:
  - id: 8c31f563-f9a7-450c-bfa8-35f8f32f1f61
    type: derived
  - id: 117d3d3a-755c-4a61-b23e-9171146d094c
    type: derived
status: test
description: This rule identifies creation of a macro document at a specific Outlook VBA project path ending with \Microsoft\Outlook\VbaProject.OTM. Attackers may use Outlook macro content as a persistence mechanism to execute VBA when Outlook processes or uses the stored project. It relies on Windows file creation telemetry, matching the target filename and excluding events where outlook.exe is the creating process.
references:
  - https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53
  - https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_outlook_susp_macro_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-08
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.command-and-control
  - attack.t1137
  - attack.t1008
  - attack.t1546
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: \Microsoft\Outlook\VbaProject.OTM
  filter:
    Image|endswith: \outlook.exe
  condition: selection and not filter
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL