Detect Outlook Rules in Google Chronicle
Adversaries abuse Microsoft Outlook rules to achieve persistence and execute code. Malicious inbox rules can be configured to run a script or application when a specially crafted email is received. Rules are stored in the mailbox and persist across Outlook restarts and even OS reinstalls. The Ruler tool automates creation of malicious rules. Hidden inbox rules (stored without display names) are particularly stealthy.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1137 Office Application Startup
- Sub-technique
- T1137.005 Outlook Rules
- Canonical reference
- https://attack.mitre.org/techniques/T1137/005/
YARA-L Detection Query
rule outlook_rules_persistence_t1137_005 {
meta:
author = "Argus Detection Engineering"
description = "Detects Outlook Rules persistence (T1137.005): Outlook spawning shell/LOLBin processes, executing binaries from user-writable paths, or Ruler tool usage for automated mailbox rule creation."
mitre_attack_tactic = "Persistence"
mitre_attack_technique = "T1137.005"
severity = "HIGH"
confidence = "HIGH"
version = "1.0"
events:
$e.metadata.event_type = "PROCESS_LAUNCH"
// Detection branch 1: Outlook spawning LOLBins (rule execution via shell)
(
re.regex($e.principal.process.file.full_path, `(?i)outlook\.exe$`)
and re.regex($e.target.process.file.full_path,
`(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil)\.exe$`)
)
or
// Detection branch 2: Outlook spawning process from user-writable directories
(
re.regex($e.principal.process.file.full_path, `(?i)outlook\.exe$`)
and re.regex($e.target.process.file.full_path,
`(?i)\\(Users|Temp|AppData|ProgramData)\\`)
and not re.regex($e.target.process.file.full_path,
`(?i)\\Microsoft\\Office\\`)
)
or
// Detection branch 3: Ruler attack tool
(
re.regex($e.target.process.file.full_path, `(?i)ruler\.exe$`)
or (
re.regex($e.target.process.command_line, `(?i)--rules`)
and re.regex($e.target.process.command_line, `(?i)(ruler|add|--target)`)
)
)
condition:
$e
}Chronicle YARA-L 2.0 rule detecting T1137.005 Outlook Rules persistence via three behavioral branches: Outlook spawning LOLBin or shell interpreter processes (indicating mailbox rule execution), Outlook launching executables from user-writable filesystem paths (indicating 'run application' rule abuse), and detection of the Ruler post-exploitation tool used to programmatically create malicious mailbox rules via MAPI or MAPI-over-HTTP.
Data Sources
Required Tables
False Positives & Tuning
- Outlook-based ticketing integrations that legitimately spawn PowerShell or cmd.exe to process incoming email events according to subject-line rules in enterprise ITSM environments
- Email-driven CI/CD or DevOps notification systems that use Outlook rules to trigger build scripts or deployment notifications via command execution
- Authorized red team or penetration testing engagements using Ruler against Exchange Online or on-premises Exchange in the organization's environment
Other platforms for T1137.005
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Malicious Outlook Inbox Rule via PowerShell (Exchange)
Expected signal: Security Event ID 4624 for Exchange PowerShell authentication. Office 365 Unified Audit Log: Operation=New-InboxRule with RunScript action. Sysmon EventCode 3 network connection to Exchange Online.
- Test 2Enumerate Inbox Rules for Hidden/Suspicious Entries
Expected signal: Sysmon EventCode 1 with powershell.exe executing Get-InboxRule. Exchange EWS audit log showing mailbox access from local machine.
- Test 3Test Ruler Tool Detection (Simulated Command)
Expected signal: Sysmon EventCode 1 with cmd.exe process. For actual Ruler execution: Image=ruler.exe, CommandLine containing '--rules' and '--trigger'. Sysmon EventCode 3 connection to Exchange EWS.
References (6)
- https://attack.mitre.org/techniques/T1137/005/
- https://silentbreaksecurity.com/malicious-outlook-rules/
- https://blog.compass-security.com/2018/09/hidden-inbox-rules-in-microsoft-exchange/
- https://github.com/sensepost/ruler
- https://github.com/sensepost/notruler
- https://docs.microsoft.com/en-us/office365/securitycompliance/detect-and-remediate-outlook-rules-forms-attack
Unlock Pro Content
Get the full detection package for T1137.005 including response playbook, investigation guide, and atomic red team tests.