huntrule

Windows: New Outlook VBAProject OTM Macro File Created

Flags Windows file creation of Outlook VBAProject.OTM when initiated by outlook.exe.

FreeReviewedSigma · Medium · v2
Product
windows
Category
file_event
Author
@ScoubiMtl (SigmaHQ), DRL 1.1
Published
2021-04-05
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Persistence → C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies the creation of a macro document associated with Outlook by matching a file creation target ending in '\Microsoft\Outlook\VbaProject.OTM' and an originating process ending with '\outlook.exe'. Creating or planting this macro file can enable persistent email-based execution under the context of the Outlook application. It relies on Windows file event telemetry that records both the creating process and the full target filename.

Reporting behind it

Related detections9 linkedT1137 — drag to rearrange
Windows: Suspicious Outlook VbaProject.OTM Macro File Created
Windows Persistence: Outlook LoadMacroProviderOnBoot Registry Setting Modification
Windows Registry: Outlook Macro Security Level Set to Enable All Macros
Suspicious Office Application Spawning Mshta With Remote HTA
AdminSDHolder Permissions Changed for Persistence (via security)
Malicious NotDoor Outlook VBA Persistence via VbaProject.OTM Deployment (via process_creation)
Malicious NotDoor Outlook Macro Auto-Execution Enablement via Registry (via registry_set)
Suspicious Persistence via Shell Script Dropped in profile.d Directory (via file_event)
Office Persistence via WLL Add-in Dropped to Word STARTUP Folder
Windows: New Outlook VBAProject OTM Macro File Created
Pivot detection · T1137 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.