{"id":"fabb0e80-030c-4e3e-a104-d09676991ac3","title":"Suspicious File Created in Outlook Temporary Directory","description":"Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening attachments.\nThis can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code.\n","author":"Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-07-22","modified":"","tags":["attack.initial-access","attack.t1566.001"],"technique_ids":["T1566.001"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["Opening of headers or footers in email signatures that include SVG images or legitimate SVG attachments"],"references":["https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/","https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/","https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/"],"source_path":"rules/windows/file/file_event/file_event_win_office_outlook_susp_file_creation_in_temp_dir.yml","source_sha256":"e3ffc5b745d0132f7f8665414ff6ea3e4f2f3d9e099d86ce947d1e7aa4467371","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_office_outlook_susp_file_creation_in_temp_dir.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious File Created in Outlook Temporary Directory\nid: fabb0e80-030c-4e3e-a104-d09676991ac3\nrelated:\n    - id: f748c45a-f8d3-4e6f-b617-fe176f695b8f\n      type: obsolete\nstatus: experimental\ndescription: |\n    Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening attachments.\n    This can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code.\nreferences:\n    - https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/\n    - https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/\n    - https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/\nauthor: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-07-22\ntags:\n    - attack.initial-access\n    - attack.t1566.001\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection_extension:\n        TargetFilename|endswith:\n            - '.cpl'\n            - '.hta'\n            - '.iso'\n            - '.rdp'\n            - '.svg'\n            - '.vba'\n            - '.vbe'\n            - '.vbs'\n    selection_location:\n        - TargetFilename|contains:\n              - '\\AppData\\Local\\Packages\\Microsoft.Outlook_'\n              - '\\AppData\\Local\\Microsoft\\Olk\\Attachments\\'\n        - TargetFilename|contains|all:\n              - '\\AppData\\Local\\Microsoft\\Windows\\'\n              - '\\Content.Outlook\\'\n    condition: all of selection_*\nfalsepositives:\n    - Opening of headers or footers in email signatures that include SVG images or legitimate SVG attachments\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1566.001","id":"T1566.001","name":"Spearphishing Attachment","page":"techniques/enterprise/T1566.001/"}],"data_path":"data/detection-rules/fabb0e80-030c-4e3e-a104-d09676991ac3.json","kind":"sigma"}