Techniques › T1137 › T1137.003

T1137.003 Outlook Forms

persistence — Windows, Office Suite · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

• DET0029 Detect Persistence via Outlook Custom Forms Triggered by Malicious Email v1.0
  AN0085 Windows

  Adversary uses a tool like Ruler to insert a malicious custom form into the user's Outlook mailbox. The form is designed to auto-execute on Outlook startup or on receipt of a specially crafted email. This results in child processes launched from outlook.exe and possibly network connections or payload loading.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  WinEventLog:Application Outlook errors loading or processing custom form templates → DC0038 Application Log Content

  WinEventLog:PowerShell Execution of Microsoft script to enumerate custom forms in Outlook mailbox → DC0064 Command Execution

  Tunable: FormStorageLocation ChildProcessName TimeWindow OutlookVersion UserContext
  AN0086 Office Suite

  Outlook form execution upon message receipt or client launch results in automated code execution within user session. Form definitions deviate from standard templates and include script logic or COM object calls embedded in form fields.

  m365:unified Unusual form activity within Outlook client, including load of non-default forms → DC0038 Application Log Content

  m365:messagetrace Inbound email triggers execution of mailbox-stored custom form → DC0064 Command Execution

  Tunable: AuditPolicyScope MessageSenderAnomalyThreshold FormExecutionRate

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1137.003

Rules tagged at the parent level (attack.t1137) 9

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.