Techniques › T1137 › T1137.005

T1137.005 Outlook Rules

persistence — Windows, Office Suite · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

• DET0095 Detect Persistence via Malicious Outlook Rules v1.0
  AN0263 Windows

  Adversary uses a tool like Ruler or MFCMapi to create a malicious Outlook rule that triggers execution upon receipt of a crafted email. On email delivery, Outlook executes the rule, resulting in code execution (e.g., launching mshta.exe or PowerShell). Outlook spawns a non-standard child process, often unsanctioned, without user interaction.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  WinEventLog:Application Outlook rule execution failure or abnormal rule execution context → DC0038 Application Log Content

  WinEventLog:PowerShell PowerShell launched from outlook.exe or triggered without user invocation → DC0064 Command Execution

  Tunable: ChildProcessName RuleTriggerCondition ParentProcessName TimeWindow
  AN0264 Office Suite

  Adversary adds a new Outlook rule with modified or obfuscated PR_RULE_MSG_NAME and PR_RULE_MSG_PROVIDER attributes using MFCMapi or Ruler. Rule is triggered when email arrives, executing embedded or external code. Mailbox audit logs or Unified Audit Log shows automated rule-triggered action without user interaction.

  m365:unified Creation or modification of inbox rule outside of normal user behavior → DC0038 Application Log Content

  m365:messagetrace Inbound email matches crafted rule trigger pattern tied to persistence logic → DC0064 Command Execution

  Tunable: AuditPolicyScope RuleProviderName TriggerSubjectKeywords UserContext

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1137.005

Rules tagged at the parent level (attack.t1137) 9

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.