Windows: Suspicious Outlook VbaProject.OTM Macro File Created
High-confidence file creation alert for Microsoft\Outlook\VbaProject.OTM while excluding outlook.exe.
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-02-08
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → C2Recon
Resource Dev
Initial Access
Execution
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies creation of a macro document at a specific Outlook VBA project path ending with \Microsoft\Outlook\VbaProject.OTM. Attackers may use Outlook macro content as a persistence mechanism to execute VBA when Outlook processes or uses the stored project. It relies on Windows file creation telemetry, matching the target filename and excluding events where outlook.exe is the creating process.
Reporting behind it
- mdsec.co.ukhttps://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/
- speakerdeck.comhttps://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53
- linkedin.comhttps://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_outlook_susp_macro_creation.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Suspicious Outlook VbaProject.OTM Macro File Created"
id: 34de11c8-eb14-4669-af2d-03c1cd19b3c4
related:
- id: 8c31f563-f9a7-450c-bfa8-35f8f32f1f61
type: derived
- id: 117d3d3a-755c-4a61-b23e-9171146d094c
type: derived
status: test
description: This rule identifies creation of a macro document at a specific Outlook VBA project path ending with \Microsoft\Outlook\VbaProject.OTM. Attackers may use Outlook macro content as a persistence mechanism to execute VBA when Outlook processes or uses the stored project. It relies on Windows file creation telemetry, matching the target filename and excluding events where outlook.exe is the creating process.
references:
- https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/
- https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53
- https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_outlook_susp_macro_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-08
tags:
- attack.privilege-escalation
- attack.persistence
- attack.command-and-control
- attack.t1137
- attack.t1008
- attack.t1546
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|endswith: \Microsoft\Outlook\VbaProject.OTM
filter:
Image|endswith: \outlook.exe
condition: selection and not filter
falsepositives:
- Unlikely
level: high
license: DRL-1.1