Windows Outlook Form Creation to Local FORMS Path (Persistence Risk)

title: Windows Outlook Form Creation to Local FORMS Path (Persistence Risk)
id: 503eb6f0-4db0-4968-ae0a-800ad2294a6a
status: test
description: This rule identifies creation or writes involving Outlook forms by matching file events where Outlook launches and the target path includes Outlook Forms cache/storage locations under FORMS. Attackers can use Outlook forms to introduce malicious content that may persist or be executed when forms are accessed. Detection relies on Windows file event telemetry that records the process image (outlook.exe) and the targeted file path.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=76
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=79
  - https://learn.microsoft.com/en-us/office/vba/outlook/concepts/outlook-forms/create-an-outlook-form
  - https://www.slipstick.com/developer/custom-form/clean-outlooks-forms-cache/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_outlook_newform.yml
author: Tobias Michalski (Nextron Systems), Huntrule Team
date: 2021-06-10
modified: 2023-02-22
tags:
  - attack.persistence
  - attack.t1137.003
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith: \outlook.exe
    TargetFilename|contains:
      - \AppData\Local\Microsoft\FORMS\IPM
      - \Local Settings\Application Data\Microsoft\Forms
  condition: selection
falsepositives:
  - Legitimate use of outlook forms
level: high
license: DRL-1.1
related:
  - id: c3edc6a5-d9d4-48d8-930e-aab518390917
    type: derived