New Outlook Macro Created

Title: New Outlook Macro Created
Status: test
Description:Detects the creation of a macro file for Outlook.
References:
  -https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/
Author: @ScoubiMtl
Date: 2021-04-05
modified:2023-02-08
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.command-and-control'
• -'attack.t1137'
• -'attack.t1008'
• -'attack.t1546'

Logsource:

• category: file_event
• product: windows

Detection:
  selection:
    Image|endswith: '\outlook.exe'
    TargetFilename|endswith: '\Microsoft\Outlook\VbaProject.OTM'
  condition:selection
Falsepositives:
  -User genuinely creates a VB Macro for their email
Level: medium