MITRE ATT&CKsub-technique
T1137.003 Outlook Forms
- Domain
- enterprise
- Tactics
- Persistence
- Platforms
- Windows, Office Suite
- Version
- 1.2
- Created
- 2019-11-07
Description
Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system. Outlook forms are used as templates for presentation and functionality in Outlook messages. Custom Outlook forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.
Once malicious forms have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious forms will execute when an adversary sends a specifically crafted email to the user.
Related
Subtechnique of · MITRE ATT&CK (1)
- T1137 Office Application Startup technique
Tactic · MITRE ATT&CK (1)
- TA0003 Persistence tactic
Referenced by MITRE ATT&CK · mitigates (2)
Referenced by MITRE ATT&CK · uses (1)
- S0358 Ruler software (tool)
Referenced by Compliance · mitigates (11)
- CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution CIS Safeguard v8.1
- CIS-7.4 Perform Automated Application Patch Management CIS Safeguard v8.1
- CIS-7.7 Remediate Detected Vulnerabilities CIS Safeguard v8.1
- CIS-9.1 Ensure Use of Only Fully Supported Browsers and Email Clients CIS Safeguard v8.1
- NIST-AC-6 Least Privilege NIST 800-53 control
- NIST-CM-2 Baseline Configuration NIST 800-53 control
- NIST-CM-6 Configuration Settings NIST 800-53 control
- NIST-SC-18 Mobile Code NIST 800-53 control
- NIST-SC-44 Detonation Chambers NIST 800-53 control
- NIST-SI-2 Flaw Remediation NIST 800-53 control
- NIST-SI-8 Spam Protection NIST 800-53 control
References
- https://docs.microsoft.com/en-us/office365/securitycompliance/detect-and-remediate-outlook-rules-forms-attack Microsoft Detect Outlook Forms
- https://github.com/sensepost/notruler SensePost NotRuler
- https://sensepost.com/blog/2017/outlook-forms-and-shells/ SensePost Outlook Forms