Windows Persistence Attempt Using Outlook.exe to Create Outlook Forms Cache
Flags Outlook (outlook.exe) form file activity targeting local FORMS directories often used for persistence.
- Product
- windows
- Category
- file_event
- Author
- Tobias Michalski (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-06-10
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies creation or writing of files related to Outlook forms by observing file events where outlook.exe is the initiating process and the target path is under the Outlook Forms cache directories. Attackers can use Outlook forms to persist malicious functionality within the user’s Outlook environment. The detection relies on Windows file event telemetry capturing the process image path (outlook.exe) and the target filename or directory being written.
Reporting behind it
- speakerdeck.comhttps://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=76
- speakerdeck.comhttps://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=79
- learn.microsoft.comhttps://learn.microsoft.com/en-us/office/vba/outlook/concepts/outlook-forms/create-an-outlook-form
- slipstick.comhttps://www.slipstick.com/developer/custom-form/clean-outlooks-forms-cache/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_outlook_newform.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Persistence Attempt Using Outlook.exe to Create Outlook Forms Cache
id: 503eb6f0-4db0-4968-ae0a-800ad2294a6a
status: test
description: This rule identifies creation or writing of files related to Outlook forms by observing file events where outlook.exe is the initiating process and the target path is under the Outlook Forms cache directories. Attackers can use Outlook forms to persist malicious functionality within the user’s Outlook environment. The detection relies on Windows file event telemetry capturing the process image path (outlook.exe) and the target filename or directory being written.
references:
- https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=76
- https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=79
- https://learn.microsoft.com/en-us/office/vba/outlook/concepts/outlook-forms/create-an-outlook-form
- https://www.slipstick.com/developer/custom-form/clean-outlooks-forms-cache/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_outlook_newform.yml
author: Tobias Michalski (Nextron Systems), Huntrule Team
date: 2021-06-10
modified: 2023-02-22
tags:
- attack.persistence
- attack.t1137.003
logsource:
product: windows
category: file_event
detection:
selection:
Image|endswith: \outlook.exe
TargetFilename|contains:
- \AppData\Local\Microsoft\FORMS\IPM
- \Local Settings\Application Data\Microsoft\Forms
condition: selection
falsepositives:
- Legitimate use of outlook forms
level: high
license: DRL-1.1
related:
- id: c3edc6a5-d9d4-48d8-930e-aab518390917
type: derived