Windows Outlook VBAProject.OTM Macro File Creation

Flags Windows file creation of Outlook VBAProject.OTM when initiated by outlook.exe.

FreeUnreviewedSigmamediumv1

windows-outlook-vbaproject-otm-macro-file-creation-8c31f563

title: Windows Outlook VBAProject.OTM Macro File Creation
id: d860154f-debb-443c-9c5f-41304eaf7f85
related:
  - id: 117d3d3a-755c-4a61-b23e-9171146d094c
    type: derived
  - id: 8c31f563-f9a7-450c-bfa8-35f8f32f1f61
    type: derived
status: test
description: This rule identifies file creation events where Outlook creates a macro project file at the path ending with \Microsoft\Outlook\VbaProject.OTM. Creating this file can enable mail-related persistence or follow-on command and control behaviors using Outlook macros. The detection relies on Windows file event telemetry capturing the creating process image name (outlook.exe) and the target filename path suffix.
references:
  - https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_outlook_macro_creation.yml
author: "@ScoubiMtl, Huntrule Team"
date: 2021-04-05
modified: 2023-02-08
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.command-and-control
  - attack.t1137
  - attack.t1008
  - attack.t1546
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \outlook.exe
    TargetFilename|endswith: \Microsoft\Outlook\VbaProject.OTM
  condition: selection
falsepositives:
  - User genuinely creates a VB Macro for their email
level: medium
license: DRL-1.1

What it detects

This rule identifies file creation events where Outlook creates a macro project file at the path ending with \Microsoft\Outlook\VbaProject.OTM. Creating this file can enable mail-related persistence or follow-on command and control behaviors using Outlook macros. The detection relies on Windows file event telemetry capturing the creating process image name (outlook.exe) and the target filename path suffix.

Known false positives

User genuinely creates a VB Macro for their email

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.