T1137.005: Outlook Rules

Outlook Rules matters because it turns a normal mailbox automation feature into a persistence mechanism. If a user’s Outlook mailbox has been modified after compromise, the adversary may be able to trigger code execution later by sending a crafted email, with execution occurring when Outlook starts and the malicious rule condition is met. For leaders, the key issue is not only endpoint compromise; it is whether email, identity, and endpoint teams can prove that mailbox rules are governed, monitored, and remediated.

Executive priority

Prioritize this where Microsoft Outlook and Exchange/Office Suite usage is material to business operations. The control question is whether the organization can inventory and investigate suspicious or hidden mailbox rules, correlate them with endpoint behavior, and remove them during incident response. This is relevant to operational resilience and audit evidence because mailbox-level persistence can survive simple endpoint cleanup if responders do not examine user mailbox configuration.

Technical view

This is a Windows and Office Suite persistence sub-technique under Office Application Startup. SOC and IR teams should validate detection strategy DET0095 for malicious Outlook rules and confirm that investigations include both mailbox rule state and endpoint activity around Outlook startup. The related software Ruler demonstrates that abuse of Exchange services for this behavior is documented in ATT&CK, and the external references include Microsoft guidance for detecting/remediating Outlook rules and custom forms attacks plus defensive tooling context such as NotRuler. Because ATT&CK provides no official detection text for this object, local detection engineering should be based on mailbox rule auditing, Exchange/Office 365 administrative logs, and endpoint process telemetry tied to Outlook execution.

Likely telemetry

Mailbox rule creation, modification, and deletion events
Exchange or Office 365 administrative and audit logs
Outlook client startup and process execution telemetry on Windows endpoints
Endpoint behavior prevention or EDR alerts involving Outlook-spawned activity
Incident response mailbox configuration exports or rule inventories

Detection direction

Validate DET0095 coverage for suspicious Outlook rule persistence rather than assuming generic email security monitoring will see it.
Baseline legitimate mailbox automation patterns so unusual rule actions, hidden rules, or rule changes after suspicious account activity can be reviewed with fewer false positives.
Correlate mailbox rule changes with Outlook startup and downstream endpoint behavior, since the technique depends on malicious rules being loaded and triggered in Outlook.
Include Exchange/Office Suite logging in SOC playbooks; endpoint-only detection may miss the persistence location inside the mailbox.
Use the Ruler/NotRuler relationship as context for testing defensive visibility, without treating tool-specific indicators as complete coverage.

Mitigation priorities

Apply behavior prevention on endpoints to detect and block suspicious process behavior associated with Outlook-triggered execution.
Maintain current software updates for Windows and Office Suite components to reduce exposure to known weaknesses and improve defensive control reliability.
Implement incident response procedures that inspect and remove suspicious Outlook mailbox rules during account or endpoint compromise investigations.
Ensure administrators can audit mailbox rule changes and preserve evidence for compliance and post-incident review.
Coordinate email, identity, endpoint, and SOC teams so mailbox persistence is not left behind after password resets or endpoint remediation.

Additional notes and limits

ATT&CK identifies this as a persistence sub-technique for Windows and Office Suite involving Microsoft Outlook rules. The most important defensive decision is whether mailbox configuration telemetry is actually available to the SOC and IR teams, because the persistence mechanism is not just a file or process on the endpoint. Relationship context supports DET0095 as a detection strategy and M1040/M1051 as mitigation directions.

The official ATT&CK object does not provide detection text, and the supplied relationships do not include detailed analytics or log source requirements. This take does not assert active exploitation, specific adversary attribution, or guaranteed detection. Organizations need local evidence from Exchange/Office 365 auditing, endpoint telemetry, and mailbox rule inventories to determine exposure and coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Outlook Rules

Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system. Outlook rules allow a user to define automated behavior to manage email messages. A benign rule might, for example, automatically move an email to a particular folder in Outlook if it contains specific words from a specific sender. Malicious Outlook rules can be created that can trigger code execution when an adversary sends a specifically crafted email to that user.[1]

Once malicious rules have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious rules will execute when an adversary sends a specifically crafted email to the user.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques1 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1137	Office Application Startup	This object subtechnique of Office Application Startup.

Associated objects

Groups, software, and campaigns

S0358: Ruler

Ruler is a tool to abuse Microsoft Exchange services. It is publicly available on GitHub and the tool is executed via the command line. The creators of Ruler have also released a defensive tool, NotRuler, to detect its usage.[1][2]

WindowsOffice Suite

Relationship explorer

All related ATT&CK context

uses · ToolS0358: RulerEnterprise detects · Detection StrategyDET0095: Detect Persistence via Malicious Outlook RulesEnterprise mitigates · MitigationM1051: Update SoftwareEnterprise mitigates · MitigationM1040: Behavior Prevention on EndpointEnterprise subtechnique of · TechniqueT1137: Office Application StartupEnterprise

Mitigations

Mitigation direction

M1051: Update Software

Software updates ensure systems are protected against known vulnerabilities by applying patches and upgrades provided by vendors. Regular updates reduce the attack surface and prevent adversaries from exploiting known security gaps. This includes patching operating systems, applications, drivers, and firmware. This mitigation can be implemented through the following measures:

Regular Operating System Updates

- Implementation: Apply the latest Windows security updates monthly using WSUS (Windows Server Update Services) or a similar patch management solution. Configure systems to check for updates automatically and schedule reboots during maintenance windows. - Use Case: Prevents exploitation of OS vulnerabilities such as privilege escalation or remote code execution.

Application Patching

- Implementation: Monitor Apache's update release notes for security patches addressing vulnerabilities. Schedule updates for off-peak hours to avoid downtime while maintaining security compliance. - Use Case: Prevents exploitation of web application vulnerabilities, such as those leading to unauthorized access or data breaches.

Firmware Updates

- Implementation: Regularly check the vendor’s website for firmware updates addressing vulnerabilities. Plan for update deployment during scheduled maintenance to minimize business disruption. - Use Case: Protects against vulnerabilities that adversaries could exploit to gain access to network devices or inject malicious traffic.

Emergency Patch Deployment

- Implementation: Use the emergency patch deployment feature of the organization's patch management tool to apply updates to all affected Exchange servers within 24 hours. - Use Case: Reduces the risk of exploitation by rapidly addressing critical vulnerabilities.

Centralized Patch Management

- Implementation: Implement a centralized patch management system, such as SCCM or ManageEngine, to automate and track patch deployment across all environments. Generate regular compliance reports to ensure all systems are updated. - Use Case: Streamlines patching processes and ensures no critical systems are missed.

*Tools for Implementation*

Patch Management Tools:

- WSUS: Manage and deploy Microsoft updates across the organization. - ManageEngine Patch Manager Plus: Automate patch deployment for OS and third-party apps. - Ansible: Automate updates across multiple platforms, including Linux and Windows.

Vulnerability Scanning Tools:

- OpenVAS: Open-source vulnerability scanning to identify missing patches.

M1040: Behavior Prevention on Endpoint

Behavior Prevention on Endpoint refers to the use of technologies and strategies to detect and block potentially malicious activities by analyzing the behavior of processes, files, API calls, and other endpoint events. Rather than relying solely on known signatures, this approach leverages heuristics, machine learning, and real-time monitoring to identify anomalous patterns indicative of an attack. This mitigation can be implemented through the following measures:

Suspicious Process Behavior:

- Implementation: Use Endpoint Detection and Response (EDR) tools to monitor and block processes exhibiting unusual behavior, such as privilege escalation attempts. - Use Case: An attacker uses a known vulnerability to spawn a privileged process from a user-level application. The endpoint tool detects the abnormal parent-child process relationship and blocks the action.

Unauthorized File Access:

- Implementation: Leverage Data Loss Prevention (DLP) or endpoint tools to block processes attempting to access sensitive files without proper authorization. - Use Case: A process tries to read or modify a sensitive file located in a restricted directory, such as /etc/shadow on Linux or the SAM registry hive on Windows. The endpoint tool identifies this anomalous behavior and prevents it.

Abnormal API Calls:

- Implementation: Implement runtime analysis tools to monitor API calls and block those associated with malicious activities. - Use Case: A process dynamically injects itself into another process to hijack its execution. The endpoint detects the abnormal use of APIs like `OpenProcess` and `WriteProcessMemory` and terminates the offending process.

Exploit Prevention:

- Implementation: Use behavioral exploit prevention tools to detect and block exploits attempting to gain unauthorized access. - Use Case: A buffer overflow exploit is launched against a vulnerable application. The endpoint detects the anomalous memory write operation and halts the process.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.1
Object version: 1.2
Created: Nov 7, 2019, 20:00 UTC (UTC+00:00)
Modified: Oct 24, 2025, 17:48 UTC (UTC+00:00)
Raw hash: ff791a66d532bea8...

Imported snapshots across ATT&CK releases(1)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.2	Oct 24, 2025, 17:48 UTC (UTC+00:00)	Current bundle	`ff791a66d532…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
SilentBreak Outlook Rules
Landers, N. (2015, December 4). Malicious Outlook Rules. Retrieved February 4, 2019.
Open source URL
[2]
SensePost Ruler GitHub
SensePost. (2016, August 18). Ruler: A tool to abuse Exchange services. Retrieved February 4, 2019.
Open source URL
[3]
SensePost Outlook Forms
Stalmans, E. (2017, April 28). Outlook Forms and Shells. Retrieved February 4, 2019.
Open source URL
[4]
SensePost Outlook Home Page
Stalmans, E. (2017, October 11). Outlook Home Page – Another Ruler Vector. Retrieved February 4, 2019.
Open source URL
[5]
win10_asr
Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.
Open source URL
[6]
Microsoft Detect Outlook Forms
Fox, C., Vangel, D. (2018, April 22). Detect and Remediate Outlook Rules and Custom Forms Injections Attacks in Office 365. Retrieved February 4, 2019.
Open source URL
[7]
Microsoft Detect Outlook Forms
Fox, C., Vangel, D. (2018, April 22). Detect and Remediate Outlook Rules and Custom Forms Injections Attacks in Office 365. Retrieved February 4, 2019.
Open source URL
[8]
Microsoft Detect Outlook Forms
Fox, C., Vangel, D. (2018, April 22). Detect and Remediate Outlook Rules and Custom Forms Injections Attacks in Office 365. Retrieved February 4, 2019.
Open source URL
[9]
Pfammatter - Hidden Inbox Rules
Damian Pfammatter. (2018, September 17). Hidden Inbox Rules in Microsoft Exchange. Retrieved October 12, 2021.
Open source URL
[10]
Pfammatter - Hidden Inbox Rules
Damian Pfammatter. (2018, September 17). Hidden Inbox Rules in Microsoft Exchange. Retrieved October 12, 2021.
Open source URL
[11]
Pfammatter - Hidden Inbox Rules
Damian Pfammatter. (2018, September 17). Hidden Inbox Rules in Microsoft Exchange. Retrieved October 12, 2021.
Open source URL
[12]
SensePost NotRuler
SensePost. (2017, September 21). NotRuler - The opposite of Ruler, provides blue teams with the ability to detect Ruler usage against Exchange. Retrieved February 4, 2019.
Open source URL
[13]
SensePost NotRuler
SensePost. (2017, September 21). NotRuler - The opposite of Ruler, provides blue teams with the ability to detect Ruler usage against Exchange. Retrieved February 4, 2019.
Open source URL
[14]
SensePost NotRuler
SensePost. (2017, September 21). NotRuler - The opposite of Ruler, provides blue teams with the ability to detect Ruler usage against Exchange. Retrieved February 4, 2019.
Open source URL
[15]
SilentBreak Outlook Rules
Landers, N. (2015, December 4). Malicious Outlook Rules. Retrieved February 4, 2019.
Open source URL
[16]
SilentBreak Outlook Rules
Landers, N. (2015, December 4). Malicious Outlook Rules. Retrieved February 4, 2019.
Open source URL
[17]
mitre-attackT1137.005
Open source URL
[18]
mitre-attackT1137.005
Open source URL
[19]
mitre-attackT1137.005
Open source URL
[20]
SensePost Ruler GitHub
SensePost. (2016, August 18). Ruler: A tool to abuse Exchange services. Retrieved February 4, 2019.
Open source URL
[21]
SensePost Outlook Forms
Stalmans, E. (2017, April 28). Outlook Forms and Shells. Retrieved February 4, 2019.
Open source URL
[22]
SensePost Outlook Home Page
Stalmans, E. (2017, October 11). Outlook Home Page – Another Ruler Vector. Retrieved February 4, 2019.
Open source URL
[23]
win10_asr
Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use