Windows Process Creation: Outlook EnableUnsafeClientMailRules Security Setting Enabled

title: "Windows Process Creation: Outlook EnableUnsafeClientMailRules Security Setting Enabled"
id: 8beae457-ca8b-4688-ab87-3ea76e5c849c
related:
  - id: 6763c6c8-bd01-4687-bc8d-4fa52cf8ba08
    type: similar
  - id: 55f0a3a1-846e-40eb-8273-677371b8d912
    type: derived
status: test
description: This rule identifies Windows process executions whose command line includes the path to the Outlook security setting EnableUnsafeClientMailRules. Enabling this setting reduces restrictions around client mail rules, which can help an attacker persist or execute unwanted behavior via Outlook. It relies on process creation telemetry and matches on a specific command-line substring referencing the Outlook security configuration.
references:
  - https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=44
  - https://support.microsoft.com/en-us/topic/how-to-control-the-rule-actions-to-start-an-application-or-run-a-macro-in-outlook-2016-and-outlook-2013-e4964b72-173c-959d-5d7b-ead562979048
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.yml
author: Markus Neis, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2018-12-27
modified: 2023-02-09
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: \Outlook\Security\EnableUnsafeClientMailRules
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1