1200KM / sigma-rule
Suspicious Execution From Outlook Temporary Folder — Sigma Rule
Sigma rule a018fdc3-46a3-44e5-9afb-2cd4af1d4b39. Suspicious Execution From Outlook Temporary Folder — Sigma Rule. Detects a suspicious program execution in Outlook temp folder
Rule metadata and linked tags
Author: Florian Roth (Nextron Systems). Source status: test; severity: high. Source dates: 2019-10-01 / 2022-10-09.
{
"category": "process_creation",
"product": "windows"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: 0a3f93739a8da449750e56943bd8bfdc590a18a658e4c7807534e9d4bdda3291
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: Suspicious Execution From Outlook Temporary Folder
id: a018fdc3-46a3-44e5-9afb-2cd4af1d4b39
status: test
description: Detects a suspicious program execution in Outlook temp folder
author: Florian Roth (Nextron Systems)
references:
- Internal Research
date: 2019-10-01
modified: 2022-10-09
tags:
- attack.initial-access
- attack.t1566.001
logsource:
category: process_creation
product: windows
detection:
selection:
Image|contains: '\Temporary Internet Files\Content.Outlook\'
condition: selection
falsepositives:
- Unknown
level: high
False positives
- Unknown
Source references
- Internal Research (source note; no public URL supplied)
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.