Windows: Suspicious Attachment File Created in Outlook Temporary Directories

Alerts on creation of risky file types in Outlook attachment temporary folders used during email attachment handling.

FreeUnreviewedSigmahighv1

windows-suspicious-attachment-file-created-in-outlook-temporary-directories-fabb0e80

title: "Windows: Suspicious Attachment File Created in Outlook Temporary Directories"
id: af3f2874-13a9-4995-9fba-093b1ff2b2d9
related:
  - id: f748c45a-f8d3-4e6f-b617-fe176f695b8f
    type: obsolete
  - id: fabb0e80-030c-4e3e-a104-d09676991ac3
    type: derived
status: experimental
description: This rule flags creation of files with high-risk extensions (.cpl, .hta, .iso, .rdp, .svg, .vba, .vbe, .vbs) within Outlook temporary attachment storage paths. Attackers may use email attachments that temporarily land in these directories before execution or further handling. It relies on Windows file creation events and matches based on TargetFilename extension and the presence of Outlook-specific temporary directory fragments in the path.
references:
  - https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/
  - https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/
  - https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_outlook_susp_file_creation_in_temp_dir.yml
author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-07-22
tags:
  - attack.initial-access
  - attack.t1566.001
logsource:
  product: windows
  category: file_event
detection:
  selection_extension:
    TargetFilename|endswith:
      - .cpl
      - .hta
      - .iso
      - .rdp
      - .svg
      - .vba
      - .vbe
      - .vbs
  selection_location:
    - TargetFilename|contains:
        - \AppData\Local\Packages\Microsoft.Outlook_
        - \AppData\Local\Microsoft\Olk\Attachments\
    - TargetFilename|contains|all:
        - \AppData\Local\Microsoft\Windows\
        - \Content.Outlook\
  condition: all of selection_*
falsepositives:
  - Opening of headers or footers in email signatures that include SVG images or legitimate SVG attachments
level: high
license: DRL-1.1

What it detects

This rule flags creation of files with high-risk extensions (.cpl, .hta, .iso, .rdp, .svg, .vba, .vbe, .vbs) within Outlook temporary attachment storage paths. Attackers may use email attachments that temporarily land in these directories before execution or further handling. It relies on Windows file creation events and matches based on TargetFilename extension and the presence of Outlook-specific temporary directory fragments in the path.

Known false positives

Opening of headers or footers in email signatures that include SVG images or legitimate SVG attachments

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.