title: Outlook Form Installation
id: c3edc6a5-d9d4-48d8-930e-aab518390917
status: experimental
description: Detects the creation of new Outlook form which can contain malicious code
references:
    - https://twitter.com/blueteamsec1/status/1401290874202382336?s=20
tags:
    - attack.persistence
    - attack.t1137.003
author: Tobias Michalski
date: 2021/06/10
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image: '\outlook.exe'
        TargetFilename|contains: '\appdata\local\microsoft\FORMS\'
    condition: selection
fields:
    - TargetFilename
falsepositives:
    - unknown
level: high
