Detect Outlook Rules in CrowdStrike LogScale
Adversaries abuse Microsoft Outlook rules to achieve persistence and execute code. Malicious inbox rules can be configured to run a script or application when a specially crafted email is received. Rules are stored in the mailbox and persist across Outlook restarts and even OS reinstalls. The Ruler tool automates creation of malicious rules. Hidden inbox rules (stored without display names) are particularly stealthy.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1137 Office Application Startup
- Sub-technique
- T1137.005 Outlook Rules
- Canonical reference
- https://attack.mitre.org/techniques/T1137/005/
LogScale Detection Query
// T1137.005 — Outlook Rules Persistence
// Branch 1: Outlook spawning LOLBin or shell interpreters
#event_simpleName=ProcessRollup2
| ParentBaseFileName = /(?i)^outlook\.exe$/
| FileName = /(?i)^(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil)\.exe$/
| eval DetectionType = "Outlook_Rule_Shell_Spawn"
| eval RiskScore = 8
| table([@timestamp, ComputerName, UserName, DetectionType, RiskScore, FileName, CommandLine, ParentBaseFileName, ParentCommandLine])
// Branch 2: Outlook launching process from user-writable locations
#event_simpleName=ProcessRollup2
| ParentBaseFileName = /(?i)^outlook\.exe$/
| ImageFileName = /(?i)\\(Users|Temp|AppData|ProgramData)\\/
| ImageFileName != /(?i)\\Microsoft\\Office\\/
| eval DetectionType = "Outlook_Rule_UserDir_Exec"
| eval RiskScore = 9
| table([@timestamp, ComputerName, UserName, DetectionType, RiskScore, FileName, CommandLine, ImageFileName, ParentBaseFileName])
// Branch 3: Ruler attack tool for mailbox rule manipulation
#event_simpleName=ProcessRollup2
| case {
FileName = /(?i)^ruler\.exe$/ | eval DetectionType = "Ruler_Rules_Attack", RiskScore = 10;
CommandLine = /(?i)--rules/ AND CommandLine = /(?i)(ruler|add|--target)/ | eval DetectionType = "Ruler_Rules_Attack", RiskScore = 10
}
| table([@timestamp, ComputerName, UserName, DetectionType, RiskScore, FileName, CommandLine, ParentBaseFileName])
// Aggregate and sort all branches
| groupBy([ComputerName, UserName, DetectionType, FileName, CommandLine], function=[
min(RiskScore, as=risk_score),
count(as=event_count),
min(@timestamp, as=first_seen),
max(@timestamp, as=last_seen)
])
| sort(risk_score, order=desc)CrowdStrike LogScale CQL detection for T1137.005 Outlook Rules persistence using Falcon ProcessRollup2 endpoint telemetry. Three detection branches cover: Outlook spawning LOLBin executables triggered by mailbox rules, Outlook executing binaries from user-writable filesystem locations via 'run application' rule type, and detection of the Ruler open-source attack framework used to create hidden mailbox rules via Exchange MAPI.
Data Sources
Required Tables
False Positives & Tuning
- Outlook-connected telephony or unified communications platforms (e.g., Cisco Jabber, Teams Phone) that use rules to spawn helper executables when voicemail-to-email messages arrive
- Enterprise document management integrations (e.g., SharePoint connector, DocuSign) that spawn processes from AppData directories when triggered by specific email subjects via Outlook rules
- Authorized purple team or red team exercises where Ruler is used to test detection coverage of Exchange mailbox rule abuse in controlled lab or production-equivalent test environments
Other platforms for T1137.005
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Malicious Outlook Inbox Rule via PowerShell (Exchange)
Expected signal: Security Event ID 4624 for Exchange PowerShell authentication. Office 365 Unified Audit Log: Operation=New-InboxRule with RunScript action. Sysmon EventCode 3 network connection to Exchange Online.
- Test 2Enumerate Inbox Rules for Hidden/Suspicious Entries
Expected signal: Sysmon EventCode 1 with powershell.exe executing Get-InboxRule. Exchange EWS audit log showing mailbox access from local machine.
- Test 3Test Ruler Tool Detection (Simulated Command)
Expected signal: Sysmon EventCode 1 with cmd.exe process. For actual Ruler execution: Image=ruler.exe, CommandLine containing '--rules' and '--trigger'. Sysmon EventCode 3 connection to Exchange EWS.
References (6)
- https://attack.mitre.org/techniques/T1137/005/
- https://silentbreaksecurity.com/malicious-outlook-rules/
- https://blog.compass-security.com/2018/09/hidden-inbox-rules-in-microsoft-exchange/
- https://github.com/sensepost/ruler
- https://github.com/sensepost/notruler
- https://docs.microsoft.com/en-us/office365/securitycompliance/detect-and-remediate-outlook-rules-forms-attack
Unlock Pro Content
Get the full detection package for T1137.005 including response playbook, investigation guide, and atomic red team tests.