title: Suspicious Execution from Outlook
id: e212d415-0e93-435f-9e1a-f29005bb4723
status: test
description: Detects EnableUnsafeClientMailRules used for Script Execution from Outlook
author: Markus Neis
references:
  - https://github.com/sensepost/ruler
  - https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html
date: 2018/12/27
modified: 2022/01/07
logsource:
  category: process_creation
  product: windows
detection:
  clientMailRules:
    CommandLine|contains: 'EnableUnsafeClientMailRules'
  outlookExec:
    ParentImage|endswith: '\outlook.exe'
    CommandLine|contains|all:
      - '\\\\'
      - '\\'
      - '.exe'
  condition: clientMailRules or outlookExec
falsepositives:
  - Unknown
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1202
