Detect Outlook Rules in Microsoft Sentinel
Adversaries abuse Microsoft Outlook rules to achieve persistence and execute code. Malicious inbox rules can be configured to run a script or application when a specially crafted email is received. Rules are stored in the mailbox and persist across Outlook restarts and even OS reinstalls. The Ruler tool automates creation of malicious rules. Hidden inbox rules (stored without display names) are particularly stealthy.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1137 Office Application Startup
- Sub-technique
- T1137.005 Outlook Rules
- Canonical reference
- https://attack.mitre.org/techniques/T1137/005/
KQL Detection Query
// T1137.005 — Outlook Rules persistence detection
// Rules stored in mailbox; execution triggers from email receipt
// Part 1: Detect processes spawned by Outlook that indicate rule execution
let OutlookRuleExec = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "outlook.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe",
"mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe")
| extend DetectionType = "Outlook_Rule_Execution"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType;
// Part 2: Detect Outlook spawning executables from user-writable locations (rule: run application)
let OutlookUserExec = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "outlook.exe"
| where FolderPath has_any ("\\Users\\", "\\Temp\\", "\\AppData\\", "\\ProgramData\\")
| where FolderPath !has "\\Microsoft Office\\"
| extend DetectionType = "Outlook_UserDir_Execution"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, FolderPath, DetectionType;
// Part 3: Detect Ruler tool targeting Outlook rules
let RulerRules = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ("--rules", "ruler") and
ProcessCommandLine has_any ("rules", "add", "--target")
or FileName =~ "ruler.exe"
| extend DetectionType = "Ruler_Rules_Attack"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, DetectionType;
union OutlookRuleExec, OutlookUserExec, RulerRules
| sort by Timestamp descThree-part detection for Outlook Rules persistence. Part 1 detects Outlook spawning shell interpreters (cmd, PowerShell, wscript) which indicates a 'Run a Script' or 'Start an Application' rule triggered. Part 2 catches Outlook spawning executables from user-writable directories, which indicates rule-triggered execution of a payload dropped to disk. Part 3 identifies Ruler tool execution with rules-related flags.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Outlook rules that run VBScripts for custom email processing (some organizations use this for compliance or workflow automation)
- IT-managed rules that launch specific applications when trigger emails are received
- Help desk automation scripts triggered by Outlook rules for ticket creation
- Outlook integration with corporate workflow systems that respond to specially formatted emails
Other platforms for T1137.005
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Malicious Outlook Inbox Rule via PowerShell (Exchange)
Expected signal: Security Event ID 4624 for Exchange PowerShell authentication. Office 365 Unified Audit Log: Operation=New-InboxRule with RunScript action. Sysmon EventCode 3 network connection to Exchange Online.
- Test 2Enumerate Inbox Rules for Hidden/Suspicious Entries
Expected signal: Sysmon EventCode 1 with powershell.exe executing Get-InboxRule. Exchange EWS audit log showing mailbox access from local machine.
- Test 3Test Ruler Tool Detection (Simulated Command)
Expected signal: Sysmon EventCode 1 with cmd.exe process. For actual Ruler execution: Image=ruler.exe, CommandLine containing '--rules' and '--trigger'. Sysmon EventCode 3 connection to Exchange EWS.
References (6)
- https://attack.mitre.org/techniques/T1137/005/
- https://silentbreaksecurity.com/malicious-outlook-rules/
- https://blog.compass-security.com/2018/09/hidden-inbox-rules-in-microsoft-exchange/
- https://github.com/sensepost/ruler
- https://github.com/sensepost/notruler
- https://docs.microsoft.com/en-us/office365/securitycompliance/detect-and-remediate-outlook-rules-forms-attack
Unlock Pro Content
Get the full detection package for T1137.005 including response playbook, investigation guide, and atomic red team tests.