T1137.003, Outlook Forms, is a persistence technique in Microsoft Outlook for Windows and Office Suite. Outlook forms are templates that control how messages look and behave. A custom form can include code.
How attackers use it
MITRE describes the pattern. Custom Outlook forms can be created that execute code when a specifically crafted email is sent by the adversary using the same form. Once malicious forms have been added to the user's mailbox, they load when Outlook starts, and they run when the adversary sends a crafted email to the user.
That makes this a persistence and re-entry mechanism that survives a reboot and even a reimage of the workstation, since the form lives in the mailbox. The MITRE page lists the tool Ruler as one used to do this.
How to detect it
MITRE's analytics describe a form inserted into the mailbox, designed to run on Outlook startup or when a crafted email arrives. The signs on the endpoint are child processes launched from outlook.exe, and possibly network connections or payload loading. A second signal is form definitions that deviate from standard templates and contain script logic or COM object calls in form fields.
Log process creation with parent and command line (Sysmon event ID 1) and alert on outlook.exe as the parent of shells or scripting engines.
How to reduce the risk
- Patch. Blocking macros may not help, because the Visual Basic engine for these features is separate from the macro engine. MITRE notes Microsoft updates for each issue. KB3191938 blocks Outlook Visual Basic and shows a malicious code warning, and KB4011091 disables custom forms by default.
- Block child processes. On Windows 10, use Attack Surface Reduction rules to stop Office applications from creating child processes.
Quick check
Why does reimaging a laptop not remove a malicious Outlook form?
The form is stored in the user's mailbox, not on the workstation, so it loads again when Outlook starts.
Sources
- MITRE ATT&CK, T1137.003 Outlook Forms
