diff --git a/rules/windows/other/win_Outlook_C2_Macro_Creation.yml b/rules/windows/file_event/win_outlook_c2_macro_creation.yml similarity index 74% rename from rules/windows/other/win_Outlook_C2_Macro_Creation.yml rename to rules/windows/file_event/win_outlook_c2_macro_creation.yml index eec322406..e2b9f0c1e 100644 --- a/rules/windows/other/win_Outlook_C2_Macro_Creation.yml +++ b/rules/windows/file_event/win_outlook_c2_macro_creation.yml @@ -1,7 +1,7 @@ -title: BEC - Outlook C2 Macro Creation +title: Outlook C2 Macro Creation id: 8c31f563-f9a7-450c-bfa8-35f8f32f1f61 status: experimental -description: Detects the creation of a macro file for Outlook. Goes with win_Outlook_C2_Registry_Key. VbaProject.OTM is explicitly mentioned in T1137. Particularly interesting if both events (Registry & File Creation happens at the same time. +description: Detects the creation of a macro file for Outlook. Goes with win_outlook_c2_registry_key. VbaProject.OTM is explicitly mentioned in T1137. Particularly interesting if both events Registry & File Creation happens at the same time. references: - https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/ author: '@ScoubiMtl'