Suspicious Outlook Macro Created

Title: Suspicious Outlook Macro Created
Status: test
Description:Detects the creation of a macro file for Outlook.
References:
  -https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/
  -https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53
  -https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-08
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.command-and-control'
• -'attack.t1137'
• -'attack.t1008'
• -'attack.t1546'

Logsource:

• category: file_event
• product: windows

Detection:
  selection:
    TargetFilename|endswith: '\Microsoft\Outlook\VbaProject.OTM'
  filter:
    Image|endswith: '\outlook.exe'
  condition:selection and not filter
Falsepositives:
  -Unlikely
Level: high