Windows: Alert on creation of Outlook VBAProject.OTM macro file

High-confidence file creation alert for Microsoft\Outlook\VbaProject.OTM while excluding outlook.exe.

FreeUnreviewedSigmahighv1

windows-alert-on-creation-of-outlook-vbaproject-otm-macro-file-117d3d3a

title: "Windows: Alert on creation of Outlook VBAProject.OTM macro file"
id: 34de11c8-eb14-4669-af2d-03c1cd19b3c4
related:
  - id: 8c31f563-f9a7-450c-bfa8-35f8f32f1f61
    type: derived
  - id: 117d3d3a-755c-4a61-b23e-9171146d094c
    type: derived
status: test
description: This rule flags Windows file creation where the target filename ends with '\Microsoft\Outlook\VbaProject.OTM', indicating an Outlook macro container being created. Attackers can use Outlook-based macro persistence to execute code when users interact with emails or Outlook features. The detection relies on file event telemetry capturing the created/target filename, and excludes events where the creating process is outlook.exe to reduce noise.
references:
  - https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53
  - https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_outlook_susp_macro_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-08
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.command-and-control
  - attack.t1137
  - attack.t1008
  - attack.t1546
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: \Microsoft\Outlook\VbaProject.OTM
  filter:
    Image|endswith: \outlook.exe
  condition: selection and not filter
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

What it detects

This rule flags Windows file creation where the target filename ends with '\Microsoft\Outlook\VbaProject.OTM', indicating an Outlook macro container being created. Attackers can use Outlook-based macro persistence to execute code when users interact with emails or Outlook features. The detection relies on file event telemetry capturing the created/target filename, and excludes events where the creating process is outlook.exe to reduce noise.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.