High-risk attachment written to the mail client secure temp folder

Siemphony@siemphonylowT1566.001unverified

Takes the delivery leg of AN0655 rather than the execution leg: an attachment of a high-risk type materialising in the Outlook secure temporary cache, the folder the mail client writes to when a user opens an attachment straight from a message — deliberately not a parent-child process rule, because the Office-spawns-a-script-host pattern already covers T1203 and T1204 and cannot tell an emailed document from a browser download, whereas this path is written only by the mail client. The extension list is shaped by Outlook's Level 1 blocked-attachment list: Outlook never writes a .exe, .js, .lnk, .hta, .reg or (on current channels) .one into this folder at all, so those types sit in `selection_ext_blocked` and are inert unless an administrator has set Level1Remove or an Exchange policy unblocked them — the types that survive Level 1 are precisely the ones attackers moved to, and they are the live surface here. Suffix matching on a delivery artefact is a list-maintenance problem rather than a behavioural one, so any unlisted extension defeats the rule outright; the values are authored to populate MITRE's `AttachmentExtensions` knob and are not supplied by MITRE. A match is evidence of delivery, not execution — Outlook writes the cache copy when the attachment is opened or previewed, so a user who looked and closed produces the same event as one who detonated, and the alert must be pivoted to process creation before it means anything. Requires Sysmon EventID 11 with this path not excluded (stock configurations filter file-create events aggressively), and it covers classic outlook.exe only: the new Outlook client and webmail use a different cache, and an attachment saved through Save As to Downloads never touches this folder. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0236, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceFileEvents| where (FolderPath contains "\\Content.Outlook\\" and ((FolderPath endswith ".docm" or FolderPath endswith ".xlsm" or FolderPath endswith ".xlam" or FolderPath endswith ".xll" or FolderPath endswith ".pptm" or FolderPath endswith ".jar" or FolderPath endswith ".iso" or FolderPath endswith ".img" or FolderPath endswith ".vhd" or FolderPath endswith ".vhdx" or FolderPath endswith ".svg" or FolderPath endswith ".htm" or FolderPath endswith ".html") or (FolderPath endswith ".zip" or FolderPath endswith ".7z" or FolderPath endswith ".rar" or FolderPath endswith ".cab") or (FolderPath endswith ".exe" or FolderPath endswith ".scr" or FolderPath endswith ".pif" or FolderPath endswith ".com" or FolderPath endswith ".cmd" or FolderPath endswith ".bat" or FolderPath endswith ".ps1" or FolderPath endswith ".vbs" or FolderPath endswith ".vbe" or FolderPath endswith ".js" or FolderPath endswith ".jse" or FolderPath endswith ".wsf" or FolderPath endswith ".hta" or FolderPath endswith ".lnk" or FolderPath endswith ".chm" or FolderPath endswith ".reg" or FolderPath endswith ".one")))

Splunk · SPL

Run this as a search.

index=* (TargetFilename="*\\Content.Outlook\\*" AND ((TargetFilename="*.docm" OR TargetFilename="*.xlsm" OR TargetFilename="*.xlam" OR TargetFilename="*.xll" OR TargetFilename="*.pptm" OR TargetFilename="*.jar" OR TargetFilename="*.iso" OR TargetFilename="*.img" OR TargetFilename="*.vhd" OR TargetFilename="*.vhdx" OR TargetFilename="*.svg" OR TargetFilename="*.htm" OR TargetFilename="*.html") OR (TargetFilename="*.zip" OR TargetFilename="*.7z" OR TargetFilename="*.rar" OR TargetFilename="*.cab") OR (TargetFilename="*.exe" OR TargetFilename="*.scr" OR TargetFilename="*.pif" OR TargetFilename="*.com" OR TargetFilename="*.cmd" OR TargetFilename="*.bat" OR TargetFilename="*.ps1" OR TargetFilename="*.vbs" OR TargetFilename="*.vbe" OR TargetFilename="*.js" OR TargetFilename="*.jse" OR TargetFilename="*.wsf" OR TargetFilename="*.hta" OR TargetFilename="*.lnk" OR TargetFilename="*.chm" OR TargetFilename="*.reg" OR TargetFilename="*.one")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(file.path) LIKE "*\\\\content.outlook\\\\*" AND ((TO_LOWER(file.path) LIKE "*.docm" OR TO_LOWER(file.path) LIKE "*.xlsm" OR TO_LOWER(file.path) LIKE "*.xlam" OR TO_LOWER(file.path) LIKE "*.xll" OR TO_LOWER(file.path) LIKE "*.pptm" OR TO_LOWER(file.path) LIKE "*.jar" OR TO_LOWER(file.path) LIKE "*.iso" OR TO_LOWER(file.path) LIKE "*.img" OR TO_LOWER(file.path) LIKE "*.vhd" OR TO_LOWER(file.path) LIKE "*.vhdx" OR TO_LOWER(file.path) LIKE "*.svg" OR TO_LOWER(file.path) LIKE "*.htm" OR TO_LOWER(file.path) LIKE "*.html") OR (TO_LOWER(file.path) LIKE "*.zip" OR TO_LOWER(file.path) LIKE "*.7z" OR TO_LOWER(file.path) LIKE "*.rar" OR TO_LOWER(file.path) LIKE "*.cab") OR (TO_LOWER(file.path) LIKE "*.exe" OR TO_LOWER(file.path) LIKE "*.scr" OR TO_LOWER(file.path) LIKE "*.pif" OR TO_LOWER(file.path) LIKE "*.com" OR TO_LOWER(file.path) LIKE "*.cmd" OR TO_LOWER(file.path) LIKE "*.bat" OR TO_LOWER(file.path) LIKE "*.ps1" OR TO_LOWER(file.path) LIKE "*.vbs" OR TO_LOWER(file.path) LIKE "*.vbe" OR TO_LOWER(file.path) LIKE "*.js" OR TO_LOWER(file.path) LIKE "*.jse" OR TO_LOWER(file.path) LIKE "*.wsf" OR TO_LOWER(file.path) LIKE "*.hta" OR TO_LOWER(file.path) LIKE "*.lnk" OR TO_LOWER(file.path) LIKE "*.chm" OR TO_LOWER(file.path) LIKE "*.reg" OR TO_LOWER(file.path) LIKE "*.one")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,file_event,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetFilename" type="pcre2">(?i)\\Content\.Outlook\\</field>    <field name="TargetFilename" type="pcre2">(?i)((\.docm$|\.xlsm$|\.xlam$|\.xll$|\.pptm$|\.jar$|\.iso$|\.img$|\.vhd$|\.vhdx$|\.svg$|\.htm$|\.html$)|(\.zip$|\.7z$|\.rar$|\.cab$)|(\.exe$|\.scr$|\.pif$|\.com$|\.cmd$|\.bat$|\.ps1$|\.vbs$|\.vbe$|\.js$|\.jse$|\.wsf$|\.hta$|\.lnk$|\.chm$|\.reg$|\.one$))</field>    <description>High-risk attachment written to the mail client secure temp folder</description>    <mitre>      <id>T1566.001</id>    </mitre>  </rule></group>

At a glance

Logsource: file_event / windows
Level: low
Category: office_macro_execution
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 79adda3b-c69d-4df3-851a-80482f25c547

ATT&CKT1566.001

T1566.001Spearphishing Attachment

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonoffice macro execution

office macro execution

01 · What this rule detects

A document application — Word, Excel, PowerPoint, Outlook, Publisher, Visio — starting a shell, a script host or a signed proxy binary. The document is the delivery vehicle and the child process is the first thing the attacker actually controls. It is one of the most durable detections available because the parent-child relationship is a property of how the payload has to run, not a string the attacker chooses.

02 · Telemetry you need

Process creation with ParentImage and the full command line — Sysmon EventID 1, or Security 4688 with Audit Process Creation plus the command-line inclusion policy; both off by default, and 4688 without the second one gives you the child process with no arguments
Sysmon EventID 7 (ImageLoad) for the macro runtime — VBE7.DLL and its companions loading into an Office process tells you a macro ran even when nothing was spawned
Sysmon EventID 11 (FileCreate) under %TEMP%, INetCache and the Outlook secure temp folder, where the attachment lands before it is opened
Sysmon EventID 15 (FileCreateStreamHash) for the Mark of the Web zone identifier, which records that the document arrived from outside
Sysmon EventID 3 (NetworkConnect) initiated by the Office process itself

03 · How the logic works

The rule is ParentImage in the Office set AND Image in a child set — shells, script hosts, the signed proxy binaries, and any process launched from a user-writable path. ParentImage carries the signal; the child list is the part you widen over time. The important weakness to teach is that the parent link is breakable: a macro that goes through WMI or a COM object gets its child reparented away from Office, and the rule silently stops matching for exactly the samples that bothered to evade it. That is why the macro-runtime image load and Office writing an executable file are worth having as separate rules rather than as extra conditions on this one — they survive the reparenting. Outlook deserves its own rule too: as a parent it means something different from Word, and the volume profile is different.

04 · Common false positives

Genuine business macros — finance and reporting workbooks that shell out, refresh external data or drive another application
Office add-ins and vendor integrations that launch helper processes, including document management and e-signature tooling
Mail merge, document conversion and reporting pipelines that automate Office on a server
Helpdesk and repair scripts that invoke Office repair or start a shell from a template
Office spawning ordinary Windows infrastructure processes as part of normal operation

05 · Detection maturity

Tier 1 — starting point: Matches an Office application spawning cmd.exe or PowerShell.
Tier 2 — tuned: Covers the full parent set against a broad child set including script hosts and proxy binaries, with named business macros excluded by document path.
Tier 3 — correlated: Adds the macro runtime load and the Mark of the Web, and correlates the chain with what the child process did on the network or wrote to disk.

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude by the document or template path, or by the host running the automation, rather than by the child process — dropping cmd.exe from the child list to quieten one workbook blinds the rule everywhere
Raise severity when the document carries a Mark of the Web zone identifier, and again when it came from Outlook's temp folder
Keep the child list additive, and include 'anything launched from a user-writable directory' as a condition rather than trying to name every binary
Give outlook.exe as parent its own rule so the two can be tuned and prioritised independently
Where the telemetry has it, capture the grandparent as well, so the alert shows the analyst the whole chain rather than one hop

Declared by the author

Archive attachments. A .zip or .7z sent as ordinary business mail writes into this folder the moment it is opened, and on a normal mailbox that is the entire result set by a wide margin — which is why the level is set no higher than low and why selection_ext_archive is kept separate so it can be dropped first.
Macro-enabled business documents. Finance and engineering teams exchange .xlsm and .docm attachments as routine work, and opening one writes a file here that is indistinguishable at the file-creation event from a weaponised copy.
Web and image attachments: .htm, .html and .svg files circulated by marketing, design and reporting teams, or saved newsletters and exported dashboards, all of which land here on preview.
Vendor and internal IT mail carrying signed installers, .iso images or .vhd disk images for software distribution, which look identical to container-delivered malware at the point of write.
Mailbox automation such as archiving, journaling, data-loss-prevention or antivirus add-ins that open every attachment on arrival, which can produce this event for an entire mailbox in one sweep.

Noise check0 of 3 fired

Fires on none of the 3 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 3 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Not verified

Security Datasets — Spearphishing macro
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1566.001, evaluated against their file_event events.

Share this rule

/u/siemphony/79adda3b-c69d-4df3-851a-80482f25c547

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

High-risk attachment written to the mail client secure temp folder

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it