T1137.003 — Outlook Forms

Tactic: Persistence · Platforms: Windows, Office Suite

Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system. Outlook forms are used as templates for presentation and functionality in Outlook messages. Custom Outlook forms can be created that will execute code when a specifically crafted email is sent by an…

Sub-technique of Office Application Startup (T1137).

Sigma detection rules (2)

T1137.003 Office Application Startup: Outlook Forms

title: "T1137.003 Office Application Startup: Outlook Forms"
id: da7e9b24-0688-4a60-a580-e4bb245fe2b7
description: 'Detect Persistence via Outlook Custom Forms Triggered by Malicious Email. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: FormStorageLocation, ChildProcessName, TimeWindow, OutlookVersion, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1137/003
author: Shahrukh Khan
date: 2026-03-13
license: MIT
tags:
  - attack.persistence
  - attack.t1137.003

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    ParentImage|endswith: '\outlook.exe'
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
      - '\powershell.exe'
      - '\cmd.exe'

  condition: selection

falsepositives:
  - Legitimate Outlook add-ins or VSTO automation that launches a scripting host — rare and worth reviewing regardless.

level: high

T1137.003 Office Application Startup: Outlook Forms

title: "T1137.003 Office Application Startup: Outlook Forms"
id: cf46f842-60ad-41ca-9fdb-72c1e5dce692
description: 'Detect Persistence via Outlook Custom Forms Triggered by Malicious Email. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: AuditPolicyScope, MessageSenderAnomalyThreshold, FormExecutionRate.'
references:
  - https://attack.mitre.org/techniques/T1137/003
author: Shahrukh Khan
date: 2026-02-26
license: MIT
tags:
  - attack.persistence
  - attack.t1137.003

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation: 'Send'
  customform:
    Parameters|contains: 'IPM.Note.Custom'

  condition: selection and customform

falsepositives:
  - Legitimate custom Outlook Forms deployed by IT for structured workflows such as helpdesk ticket submission, since a malicious custom form class execution is not surfaced as a discrete unified log field.

level: medium

Related sub-techniques

Explore