T1137.005No distinct observable

Outlook Rules

PersistenceWindows, Office Suite

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

AN0263 is the brief's only analytic and its single endpoint observable is 'Outlook spawns a non-standard child process', which is already published in this corpus, verbatim, under a different technique. data/detections/T1137.003/rule.yml uses the same logsource (category process_creation, product windows), the same two fields, ParentImage|endswith '\outlook.exe' AND Image|endswith a sixteen-name script-host list that already contains MITRE's whole ChildProcessName knob for AN0263 (mshta.exe, powershell.exe, wscript.exe). Its own description states the ambiguity explicitly — 'a malicious form, an Outlook rule (T1137.005), a folder home page (T1137) and an ordinary VBA macro all produce the identical parent-child pair' — and data/detections/T1137.003/review.json returned verdict 'needs-rework' for precisely this scope drift, noting the firing set is also a strict subset of data/detections/ […]

Covered instead by T1137.003, T1137, T1203.

What the technique is

Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system. Outlook rules allow a user to define automated behavior to manage email messages. A benign rule might, for example, automatically move an email to a particular folder in Outlook if it contains specific words from a specific sender. Malicious Outlook rules can be created that can trigger code execution when an adversary sends a specifically crafted email to that user. Once malicious rules have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious rules will execute when an adversary sends a specifically crafted email to the user.

Read it on attack.mitre.org

What MITRE says you would watch

AN0263
Adversary uses a tool like Ruler or MFCMapi to create a malicious Outlook rule that triggers execution upon receipt of a crafted email. On email delivery, Outlook executes the rule, resulting in code execution (e.g., launching mshta.exe or PowerShell). Outlook spawns a non-standard child process, often unsanctioned, without user interaction.
AN0264
Adversary adds a new Outlook rule with modified or obfuscated PR_RULE_MSG_NAME and PR_RULE_MSG_PROVIDER attributes using MFCMapi or Ruler. Rule is triggered when email arrives, executing embedded or external code. Mailbox audit logs or Unified Audit Log shows automated rule-triggered action without user interaction.