Detect Outlook Rules in Sumo Logic CSE
Adversaries abuse Microsoft Outlook rules to achieve persistence and execute code. Malicious inbox rules can be configured to run a script or application when a specially crafted email is received. Rules are stored in the mailbox and persist across Outlook restarts and even OS reinstalls. The Ruler tool automates creation of malicious rules. Hidden inbox rules (stored without display names) are particularly stealthy.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1137 Office Application Startup
- Sub-technique
- T1137.005 Outlook Rules
- Canonical reference
- https://attack.mitre.org/techniques/T1137/005/
Sumo Detection Query
// T1137.005 — Outlook Rules Persistence
_sourceCategory="WinEventLog/Sysmon" OR _sourceCategory="os/windows/sysmon"
| where EventID = "1"
| parse field=ParentImage "*" as parent_image nodrop
| parse field=Image "*" as process_image nodrop
| parse field=CommandLine "*" as command_line nodrop
| where (
// Part 1: Outlook spawning LOLBins
(matches(toLowerCase(parent_image), ".*outlook\.exe.*") AND
matches(toLowerCase(process_image), ".*(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil)\.exe.*"))
OR
// Part 2: Outlook spawning from user-writable dirs
(matches(toLowerCase(parent_image), ".*outlook\.exe.*") AND
(matches(toLowerCase(process_image), ".*\\users\\.+") OR
matches(toLowerCase(process_image), ".*\\temp\\.+") OR
matches(toLowerCase(process_image), ".*\\appdata\\.+") OR
matches(toLowerCase(process_image), ".*\\programdata\\.+")) AND
!matches(toLowerCase(process_image), ".*microsoft\\office.*"))
OR
// Part 3: Ruler tool usage
(matches(toLowerCase(process_image), ".*ruler\.exe.*") OR
(matches(toLowerCase(command_line), ".*--rules.*") AND
matches(toLowerCase(command_line), ".*(ruler|add|--target).*")))
)
| eval detection_type = if(
matches(toLowerCase(parent_image), ".*outlook\.exe.*") AND
matches(toLowerCase(process_image), ".*(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil)\.exe.*"),
"Outlook_Rule_Shell_Spawn",
if(
matches(toLowerCase(parent_image), ".*outlook\.exe.*") AND
(matches(toLowerCase(process_image), ".*\\users\\.+") OR matches(toLowerCase(process_image), ".*\\appdata\\.+")),
"Outlook_Rule_UserDir_Exec",
"Ruler_Rules_Attack"
)
)
| eval risk_score = if(detection_type = "Ruler_Rules_Attack", 10,
if(detection_type = "Outlook_Rule_UserDir_Exec", 9, 8))
| fields _messagetime, Computer, User, detection_type, risk_score, process_image, command_line, parent_image
| sort by risk_score, _messagetimeSumo Logic CSE query detecting T1137.005 Outlook Rules persistence using Sysmon process creation events. Identifies three malicious patterns: Outlook spawning LOLBin/shell interpreters (indicating rule-triggered script execution), Outlook launching binaries from user-writable filesystem locations, and detection of the Ruler attack tool used to automate mailbox rule creation.
Data Sources
Required Tables
False Positives & Tuning
- Email-triggered automation tools such as Power Automate Desktop or UiPath that use Outlook rules to launch RPA workflows and may spawn cmd.exe or PowerShell as part of their execution chain
- Corporate help desk solutions that monitor for specific subject-line emails and invoke scripts via Outlook rules to auto-create tickets or trigger alerts
- Security tools like email gateway sandboxing solutions that spawn controlled processes from Outlook as part of attachment analysis pipelines
Other platforms for T1137.005
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Malicious Outlook Inbox Rule via PowerShell (Exchange)
Expected signal: Security Event ID 4624 for Exchange PowerShell authentication. Office 365 Unified Audit Log: Operation=New-InboxRule with RunScript action. Sysmon EventCode 3 network connection to Exchange Online.
- Test 2Enumerate Inbox Rules for Hidden/Suspicious Entries
Expected signal: Sysmon EventCode 1 with powershell.exe executing Get-InboxRule. Exchange EWS audit log showing mailbox access from local machine.
- Test 3Test Ruler Tool Detection (Simulated Command)
Expected signal: Sysmon EventCode 1 with cmd.exe process. For actual Ruler execution: Image=ruler.exe, CommandLine containing '--rules' and '--trigger'. Sysmon EventCode 3 connection to Exchange EWS.
References (6)
- https://attack.mitre.org/techniques/T1137/005/
- https://silentbreaksecurity.com/malicious-outlook-rules/
- https://blog.compass-security.com/2018/09/hidden-inbox-rules-in-microsoft-exchange/
- https://github.com/sensepost/ruler
- https://github.com/sensepost/notruler
- https://docs.microsoft.com/en-us/office365/securitycompliance/detect-and-remediate-outlook-rules-forms-attack
Unlock Pro Content
Get the full detection package for T1137.005 including response playbook, investigation guide, and atomic red team tests.