Persistence via Microsoft Outlook VBA

 1[metadata]
 2creation_date = "2020/11/23"
 3integration = ["endpoint", "windows"]
 4maturity = "production"
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Elastic"]
 9description = "Detects attempts to establish persistence on an endpoint by installing a rogue Microsoft Outlook VBA Template."
10false_positives = ["A legitimate VBA for Outlook is usually configured interactively via OUTLOOK.EXE."]
11from = "now-9m"
12index = ["logs-endpoint.events.file-*", "winlogbeat-*", "logs-windows.sysmon_operational-*", "endgame-*"]
13language = "eql"
14license = "Elastic License v2"
15name = "Persistence via Microsoft Outlook VBA"
16references = [
17    "https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/",
18    "https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/",
19]
20risk_score = 47
21rule_id = "397945f3-d39a-4e6f-8bcb-9656c2031438"
22setup = """## Setup
23
24If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
25events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
26Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
27`event.ingested` to @timestamp.
28For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
29"""
30severity = "medium"
31tags = [
32    "Domain: Endpoint",
33    "OS: Windows",
34    "Use Case: Threat Detection",
35    "Tactic: Persistence",
36    "Data Source: Elastic Endgame",
37    "Data Source: Elastic Defend",
38    "Data Source: Sysmon",
39]
40timestamp_override = "event.ingested"
41type = "eql"
42
43query = '''
44file where host.os.type == "windows" and event.type != "deletion" and
45 file.path : "C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Outlook\\VbaProject.OTM"
46'''
47
48
49[[rule.threat]]
50framework = "MITRE ATT&CK"
51[[rule.threat.technique]]
52id = "T1137"
53name = "Office Application Startup"
54reference = "https://attack.mitre.org/techniques/T1137/"
55
56
57[rule.threat.tactic]
58id = "TA0003"
59name = "Persistence"
60reference = "https://attack.mitre.org/tactics/TA0003/"