title: Microsoft Outlook Product Spawning Windows Shell
id: 208748f7-881d-47ac-a29c-07ea84bf691d
status: test
related:
    - id: 438025f9-5856-4663-83f7-52f878a70a50
      type: derived
description: Detects a Windows command and scripting interpreter executable started from Microsoft Outlook
author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team
references:
  - https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100
  - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html
date: 2022/02/28
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\OUTLOOK.EXE'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\sh.exe'
      - '\bash.exe'
      - '\scrcons.exe'
      - '\schtasks.exe'
      - '\regsvr32.exe'
      - '\hh.exe'
      - '\wmic.exe'        # https://app.any.run/tasks/c903e9c8-0350-440c-8688-3881b556b8e0/
      - '\mshta.exe'
      # - '\rundll32.exe'  # see comment below
      - '\msiexec.exe'
      - '\forfiles.exe'
      - '\scriptrunner.exe'
      - '\mftrace.exe'
      - '\AppVLP.exe'
      - '\svchost.exe'        # https://www.vmray.com/analyses/2d2fa29185ad/report/overview.html
      - '\msbuild.exe'        # https://github.com/elastic/detection-rules/blob/main/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml

  # Several FPs with rundll32.exe - we started excluding specific use cases and 
  # ended commenting out all rundll32.exe sub processes

  #filter_outlook_photoviewer:  # https://twitter.com/Luke_Hamp/status/1495919717760237568
  #  ParentImage|endswith: '\OUTLOOK.EXE'
  #  Image|endswith: '\rundll32.exe'
  #  CommandLine|contains: '\PhotoViewer.dll'
  #filter_outlook_printattachments:  # https://twitter.com/KickaKamil/status/1496238278659485696
  #  ParentImage|endswith: '\OUTLOOK.EXE'
  #  Image|endswith: '\rundll32.exe'
  #  CommandLine|contains|all:
  #    - 'shell32.dll,Control_RunDLL'
  #    - '\SYSTEM32\SPOOL\DRIVERS\'
  condition: selection # and not 1 of filter*
fields:
  - CommandLine
  - ParentCommandLine
falsepositives:
  - Unknown
level: high
tags:
  - attack.execution
  - attack.t1204.002