Windows: New Outlook VBAProject OTM Macro File Created
Flags Windows file creation of Outlook VBAProject.OTM when initiated by outlook.exe.
- Product
- windows
- Category
- file_event
- Author
- @ScoubiMtl (SigmaHQ), DRL 1.1
- Published
- 2021-04-05
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → C2Recon
Resource Dev
Initial Access
Execution
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies the creation of a macro document associated with Outlook by matching a file creation target ending in '\Microsoft\Outlook\VbaProject.OTM' and an originating process ending with '\outlook.exe'. Creating or planting this macro file can enable persistent email-based execution under the context of the Outlook application. It relies on Windows file event telemetry that records both the creating process and the full target filename.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: New Outlook VBAProject OTM Macro File Created"
id: d860154f-debb-443c-9c5f-41304eaf7f85
related:
- id: 117d3d3a-755c-4a61-b23e-9171146d094c
type: derived
- id: 8c31f563-f9a7-450c-bfa8-35f8f32f1f61
type: derived
status: test
description: This rule identifies the creation of a macro document associated with Outlook by matching a file creation target ending in '\Microsoft\Outlook\VbaProject.OTM' and an originating process ending with '\outlook.exe'. Creating or planting this macro file can enable persistent email-based execution under the context of the Outlook application. It relies on Windows file event telemetry that records both the creating process and the full target filename.
references:
- https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_outlook_macro_creation.yml
author: "@ScoubiMtl, Huntrule Team"
date: 2021-04-05
modified: 2023-02-08
tags:
- attack.privilege-escalation
- attack.persistence
- attack.command-and-control
- attack.t1137
- attack.t1008
- attack.t1546
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith: \outlook.exe
TargetFilename|endswith: \Microsoft\Outlook\VbaProject.OTM
condition: selection
falsepositives:
- User genuinely creates a VB Macro for their email
level: medium
license: DRL-1.1