RulerS0358 ↗
Can be used to automate the abuse of Outlook Forms to establish persistence.1
tfMITRE ATT&CK sub-technique
Outlook Forms T1137.003
sub-technique of T1137 Office Application Startup
- Tactic
- Persistence
- Platforms
- Windows, Office Suite
- Version
- 1.2
- Created
- 07 November 2019
- Last modified
- 24 October 2025
Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system. Outlook forms are used as templates for presentation and functionality in Outlook messages. Custom Outlook forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.1
Detection rules42nd pct
Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.Outlook Forms MITRE reference T1137.003
44th pctamong all ATT&CK techniques for number of tools
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
All 1 software entries for this technique
Offense vs defense T1137.003
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 0
first rule: 2021 Q2Outlook Forms detection strategy DET0029
MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Persistence via Outlook Custom Forms Triggered by Malicious Email
2 platforms
AN0085 · Windows
Adversary uses a tool like Ruler to insert a malicious custom form into the user's Outlook mailbox. The form is designed to auto-execute on Outlook startup or on receipt of a specially crafted email. This results in child processes launched from outlook.exe and possibly network connections or payload loading.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Application Log ContentDC0038 | WinEventLog:Application | Outlook errors loading or processing custom form templates |
| Command ExecutionDC0064 | WinEventLog:PowerShell | Execution of Microsoft script to enumerate custom forms in Outlook mailbox |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| FormStorageLocation | Malicious forms may be stored in various user-specific locations in the Outlook mailbox (e.g., IPM.Note class) |
| ChildProcessName | Child process spawned by outlook.exe may vary (e.g., powershell.exe, rundll32.exe, mshta.exe) |
| TimeWindow | Form-triggered execution may happen immediately upon Outlook startup or with delay after crafted message arrival |
| OutlookVersion | Form behavior and error logs may vary across Outlook 2013, 2016, and M365 builds |
| UserContext | Attack may target only specific users; contextual correlation needed for account baselining |
AN0086 · Office Suite
Outlook form execution upon message receipt or client launch results in automated code execution within user session. Form definitions deviate from standard templates and include script logic or COM object calls embedded in form fields.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | m365:unified | Unusual form activity within Outlook client, including load of non-default forms |
| Command ExecutionDC0064 | m365:messagetrace | Inbound email triggers execution of mailbox-stored custom form |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AuditPolicyScope | Not all tenants may enable audit logs of custom form activity or COM component usage in Office |
| MessageSenderAnomalyThreshold | Ruler-style delivery may come from external accounts with forged headers or low reputation |
| FormExecutionRate | Frequency of form triggers may be anomalously high compared to baseline Outlook usage |
On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Office applications from creating child processes and from writing potentially malicious executable content to disk.
Update SoftwareM1051
For the Outlook methods, blocking macros may be ineffective as the Visual Basic engine used for these features is separate from the macro scripting engine. Microsoft has released patches to try to address each issue. Ensure KB3191938 which blocks Outlook Visual Basic and displays a malicious code warning, KB4011091 which disables custom forms by default, and KB4011162 which removes the legacy Home Page feature, are applied to systems.