IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Suspicious Inter-Process Communication via Outlookedit
Detects Inter-Process Communication with Outlook via Component Object Model from an unusual process. Adversaries may target user email to collect sensitive information or send email on their behalf via API.
Rule type: eql
Rule indices:
- logs-endpoint.events.*
Severity: medium
Risk score: 47
Runs every: 5m
Searches indices from: now-9m (Date Math format, see also Additional look-back time)
Maximum alerts per execution: 100
References:
Tags:
- Domain: Endpoint
- OS: Windows
- Use Case: Threat Detection
- Tactic: Collection
- Data Source: Elastic Defend
Version: 5
Rule authors:
- Elastic
Rule license: Elastic License v2
Rule queryedit
sequence with maxspan=1m
[process where host.os.type == "windows" and event.action == "start" and
(
process.name : (
"rundll32.exe", "mshta.exe", "powershell.exe", "pwsh.exe",
"cmd.exe", "regsvr32.exe", "cscript.exe", "wscript.exe"
) or
(
(process.code_signature.trusted == false or process.code_signature.exists == false) and
(process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500)
)
)
] by process.executable
[process where host.os.type == "windows" and event.action == "start" and process.name : "OUTLOOK.EXE" and
process.Ext.effective_parent.name != null] by process.Ext.effective_parent.executable
Framework: MITRE ATT&CKTM
-
Tactic:
- Name: Collection
- ID: TA0009
- Reference URL: https://attack.mitre.org/tactics/TA0009/
-
Technique:
- Name: Email Collection
- ID: T1114
- Reference URL: https://attack.mitre.org/techniques/T1114/
-
Sub-technique:
- Name: Local Email Collection
- ID: T1114.001
- Reference URL: https://attack.mitre.org/techniques/T1114/001/
-
Tactic:
- Name: Execution
- ID: TA0002
- Reference URL: https://attack.mitre.org/tactics/TA0002/
-
Technique:
- Name: Inter-Process Communication
- ID: T1559
- Reference URL: https://attack.mitre.org/techniques/T1559/
-
Sub-technique:
- Name: Component Object Model
- ID: T1559.001
- Reference URL: https://attack.mitre.org/techniques/T1559/001/