Techniques
Sample rules
New Outlook Macro Created
- source: sigma
- technicques:
- t1008
- t1137
- t1546
Description
Detects the creation of a macro file for Outlook.
Detection logic
condition: selection
selection:
Image|endswith: \outlook.exe
TargetFilename|endswith: \Microsoft\Outlook\VbaProject.OTM