Detection: Detect Outlook exe writing a zip file

EXPERIMENTAL DETECTION

This detection status is set to experimental. The Splunk Threat Research team has not yet fully tested, simulated, or built comprehensive datasets for this detection. As such, this analytic is not officially supported. If you have any questions or concerns, please reach out to us at research@splunk.com.

Updated Date: 2025-02-10 ID: a51bfe1a-94f0-4822-b1e4-16ae10145893 Author: Bhavin Patel, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following analytic identifies the execution of outlook.exe writing a .zip file to the disk. It leverages data from the Endpoint data model, specifically monitoring process and filesystem activities. This behavior is significant as it may indicate the use of Outlook to deliver malicious payloads or exfiltrate data via compressed files. If confirmed malicious, this activity could lead to unauthorized data access, data exfiltration, or the delivery of malware, potentially compromising the security of the affected system and network.

 1
 2| tstats `security_content_summariesonly`  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe by _time span=5m Processes.parent_process_id Processes.process_id Processes.dest Processes.process_name Processes.parent_process_name Processes.user 
 3| `drop_dm_object_name(Processes)` 
 4| `security_content_ctime(firstTime)` 
 5| `security_content_ctime(lastTime)` 
 6| rename process_id as malicious_id
 7| rename parent_process_id as outlook_id
 8| join malicious_id type=inner[
 9| tstats `security_content_summariesonly` count values(Filesystem.file_path) as file_path values(Filesystem.file_name) as file_name  FROM datamodel=Endpoint.Filesystem where (Filesystem.file_path=*.zip*   OR Filesystem.file_name=*.lnk ) AND (Filesystem.file_path=C:\\Users* OR Filesystem.file_path=*Local\\Temp*) by  _time span=5m Filesystem.process_id Filesystem.file_hash Filesystem.dest  
10| `drop_dm_object_name(Filesystem)` 
11| `security_content_ctime(firstTime)` 
12| `security_content_ctime(lastTime)` 
13| rename process_id as malicious_id
14| fields malicious_id outlook_id dest file_path file_name file_hash count file_id] 
15| table firstTime lastTime user malicious_id outlook_id process_name parent_process_name file_name  file_path 
16| where file_name != "" 
17| `detect_outlook_exe_writing_a_zip_file_filter`
spl

Data Source

Name Platform Sourcetype Source
Sysmon EventID 1 Windows icon Windows 'xmlwineventlog' 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
Sysmon EventID 11 Windows icon Windows 'xmlwineventlog' 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

Macros Used

Name Value
security_content_ctime convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)
detect_outlook_exe_writing_a_zip_file_filter search *
detect_outlook_exe_writing_a_zip_file_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1566.001 Spearphishing Attachment Initial Access
Delivery
DE.CM
CIS 13

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Notable Yes
Rule Title %name%
Rule Description %description%
Notable Event Fields user, dest
Creates Risk Event True
This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.

Implementation

You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon.

Known False Positives

It is not uncommon for outlook to write legitimate zip files to the disk.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message:

ZIP file written by outlook.exe on $dest$

Risk Object Risk Object Type Risk Score Threat Objects
dest system 25 No Threat Objects
user user 25 No Threat Objects

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation Not Applicable N/A N/A N/A
Unit ❌ Failing N/A N/A N/A
Integration ❌ Failing N/A N/A N/A

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 10