Windows: Suspicious Attachment File Created in Outlook Temp Directories
Alerts on creation of risky file types in Outlook attachment temporary folders used during email attachment handling.
- Product
- windows
- Category
- file_event
- Author
- Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-07-22
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows file creation events where the filename ends with extensions often used for executable content (such as .hta, .cpl, .iso, .rdp, .svg, .vba, .vbs, and .vbe) and the file is created in Outlook’s temporary attachment locations under AppData. Attackers may rely on Outlook attachment handling to stage malicious files where they can be subsequently opened or executed. The detection relies on file event telemetry that includes the created file’s full TargetFilename, allowing extension and path substring matching.
Reporting behind it
- vipre.comhttps://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/
- thecyberexpress.comhttps://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_outlook_susp_file_creation_in_temp_dir.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Suspicious Attachment File Created in Outlook Temp Directories"
id: af3f2874-13a9-4995-9fba-093b1ff2b2d9
related:
- id: f748c45a-f8d3-4e6f-b617-fe176f695b8f
type: obsolete
- id: fabb0e80-030c-4e3e-a104-d09676991ac3
type: derived
status: experimental
description: This rule flags Windows file creation events where the filename ends with extensions often used for executable content (such as .hta, .cpl, .iso, .rdp, .svg, .vba, .vbs, and .vbe) and the file is created in Outlook’s temporary attachment locations under AppData. Attackers may rely on Outlook attachment handling to stage malicious files where they can be subsequently opened or executed. The detection relies on file event telemetry that includes the created file’s full TargetFilename, allowing extension and path substring matching.
references:
- https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/
- https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/
- https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_outlook_susp_file_creation_in_temp_dir.yml
author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-07-22
tags:
- attack.initial-access
- attack.t1566.001
logsource:
product: windows
category: file_event
detection:
selection_extension:
TargetFilename|endswith:
- .cpl
- .hta
- .iso
- .rdp
- .svg
- .vba
- .vbe
- .vbs
selection_location:
- TargetFilename|contains:
- \AppData\Local\Packages\Microsoft.Outlook_
- \AppData\Local\Microsoft\Olk\Attachments\
- TargetFilename|contains|all:
- \AppData\Local\Microsoft\Windows\
- \Content.Outlook\
condition: all of selection_*
falsepositives:
- Opening of headers or footers in email signatures that include SVG images or legitimate SVG attachments
level: high
license: DRL-1.1