Elastic medium stable eql

Persistence via Microsoft Outlook VBA

Detects attempts to establish persistence on an endpoint by installing a rogue Microsoft Outlook VBA Template.

View Source

Detection Logic

file where host.os.type == "windows" and event.type != "deletion" and
  file.name : "VbaProject.OTM" and
  file.path : ("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Outlook\\VbaProject.OTM", "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Roaming\\Microsoft\\Outlook\\VbaProject.OTM")

False Positives

  • ⚠ A legitimate VBA for Outlook is usually configured interactively via OUTLOOK.EXE.

Field Validations

Loading…

Comments (0)

Loading comments...