{"id":"55f0a3a1-846e-40eb-8273-677371b8d912","title":"Outlook EnableUnsafeClientMailRules Setting Enabled","description":"Detects an attacker trying to enable the outlook security setting \"EnableUnsafeClientMailRules\" which allows outlook to run applications or execute macros","author":"Markus Neis, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2018-12-27","modified":"2023-02-09","tags":["attack.execution","attack.stealth","attack.t1059","attack.t1202"],"technique_ids":["T1059","T1202"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html","https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=44","https://support.microsoft.com/en-us/topic/how-to-control-the-rule-actions-to-start-an-application-or-run-a-macro-in-outlook-2016-and-outlook-2013-e4964b72-173c-959d-5d7b-ead562979048"],"source_path":"rules/windows/process_creation/proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.yml","source_sha256":"b76cfc00251715a21747f3f48a4764e9d3a0369a48aa7a997a94206fd0cbdc23","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Outlook EnableUnsafeClientMailRules Setting Enabled\nid: 55f0a3a1-846e-40eb-8273-677371b8d912\nrelated:\n    - id: 6763c6c8-bd01-4687-bc8d-4fa52cf8ba08 # Registry variation\n      type: similar\nstatus: test\ndescription: Detects an attacker trying to enable the outlook security setting \"EnableUnsafeClientMailRules\" which allows outlook to run applications or execute macros\nreferences:\n    - https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html\n    - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=44\n    - https://support.microsoft.com/en-us/topic/how-to-control-the-rule-actions-to-start-an-application-or-run-a-macro-in-outlook-2016-and-outlook-2013-e4964b72-173c-959d-5d7b-ead562979048\nauthor: Markus Neis, Nasreddine Bencherchali (Nextron Systems)\ndate: 2018-12-27\nmodified: 2023-02-09\ntags:\n    - attack.execution\n    - attack.stealth\n    - attack.t1059\n    - attack.t1202\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains: '\\Outlook\\Security\\EnableUnsafeClientMailRules'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"},{"key":"enterprise/T1202","id":"T1202","name":"Indirect Command Execution","page":"techniques/enterprise/T1202/"}],"data_path":"data/detection-rules/55f0a3a1-846e-40eb-8273-677371b8d912.json","kind":"sigma"}