
title: Outlook Form Installation
author: Tobias Michalski
date: 2021/06/10
description: Detects the creation of new Outlook form which can contain malicious
  code
detection:
  SELECTION_1:
    EventID: 11
  SELECTION_2:
    Image: \outlook.exe
  SELECTION_3:
    TargetFilename: '*\appdata\local\microsoft\FORMS\\*'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3)
falsepositives:
- unknown
fields:
- TargetFilename
id: c3edc6a5-d9d4-48d8-930e-aab518390917
level: high
logsource:
  category: file_event
  product: windows
references:
- https://twitter.com/blueteamsec1/status/1401290874202382336?s=20
status: experimental
tags:
- attack.persistence
- attack.t1137.003
ruletype: SIGMA
