Windows Process Creation: Outlook EnableUnsafeClientMailRules Security Setting Enabled
Flags Windows process command lines that reference Outlook’s EnableUnsafeClientMailRules security setting.
- Product
- windows
- Category
- process_creation
- Author
- Markus Neis, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2018-12-27
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows process executions whose command line includes the path to the Outlook security setting EnableUnsafeClientMailRules. Enabling this setting reduces restrictions around client mail rules, which can help an attacker persist or execute unwanted behavior via Outlook. It relies on process creation telemetry and matches on a specific command-line substring referencing the Outlook security configuration.
Reporting behind it
- fireeye.comhttps://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html
- speakerdeck.comhttps://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=44
- support.microsoft.comhttps://support.microsoft.com/en-us/topic/how-to-control-the-rule-actions-to-start-an-application-or-run-a-macro-in-outlook-2016-and-outlook-2013-e4964b72-173c-959d-5d7b-ead562979048
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Outlook EnableUnsafeClientMailRules Security Setting Enabled"
id: 8beae457-ca8b-4688-ab87-3ea76e5c849c
related:
- id: 6763c6c8-bd01-4687-bc8d-4fa52cf8ba08
type: similar
- id: 55f0a3a1-846e-40eb-8273-677371b8d912
type: derived
status: test
description: This rule identifies Windows process executions whose command line includes the path to the Outlook security setting EnableUnsafeClientMailRules. Enabling this setting reduces restrictions around client mail rules, which can help an attacker persist or execute unwanted behavior via Outlook. It relies on process creation telemetry and matches on a specific command-line substring referencing the Outlook security configuration.
references:
- https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html
- https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=44
- https://support.microsoft.com/en-us/topic/how-to-control-the-rule-actions-to-start-an-application-or-run-a-macro-in-outlook-2016-and-outlook-2013-e4964b72-173c-959d-5d7b-ead562979048
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.yml
author: Markus Neis, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2018-12-27
modified: 2023-02-09
tags:
- attack.execution
- attack.stealth
- attack.t1059
- attack.t1202
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains: \Outlook\Security\EnableUnsafeClientMailRules
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1