T1137.005 — Outlook Rules

Tactic: Persistence · Platforms: Windows, Office Suite

Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system. Outlook rules allow a user to define automated behavior to manage email messages. A benign rule might, for example, automatically move an email to a particular folder in Outlook if it contains specific…

Sub-technique of Office Application Startup (T1137).

Sigma detection rules (2)

T1137.005 Office Application Startup: Outlook Rules

title: "T1137.005 Office Application Startup: Outlook Rules"
id: ddb4b983-b501-465c-8224-015eee68d27e
description: 'Detects Outlook spawning an unusual script/shell child process, indicative of malicious rule execution. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: ChildProcessName, RuleTriggerCondition, ParentProcessName, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1137/005
author: Shahrukh Khan
date: 2026-05-13
license: MIT
tags:
  - attack.persistence
  - attack.t1137.005

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '1'
    ParentImage|endswith: '\outlook.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\powershell_ise.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_system_account

falsepositives:
  - Rare legitimate Outlook-triggered automation.

level: medium

T1137.005 Office Application Startup: Outlook Rules

title: "T1137.005 Office Application Startup: Outlook Rules"
id: d3fc64c8-b767-4d66-a6d7-fbdbe8e57236
description: 'Detect Persistence via Malicious Outlook Rules. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: AuditPolicyScope, RuleProviderName, TriggerSubjectKeywords, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1137/005
author: Shahrukh Khan
date: 2026-03-10
license: MIT
tags:
  - attack.persistence
  - attack.t1137.005

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation:
      - 'New-InboxRule'
      - 'Set-InboxRule'
  triggerkeywords:
    Parameters|contains:
      - 'invoice'
      - 'payment'
      - 'wire'

  condition: selection and triggerkeywords

falsepositives:
  - Legitimate finance team rules that route invoice or payment related email to dedicated processing folders.

level: medium

Related sub-techniques

Explore