Microsoft VBA For Outlook Addin Loaded Via Outlook

Title: Microsoft VBA For Outlook Addin Loaded Via Outlook
Status: test
Description:Detects outlvba (Microsoft VBA for Outlook Addin) DLL being loaded by the outlook process
References:
  -https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=58
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-08
modified:2024-03-12
Tags:

• -'attack.execution'
• -'attack.t1204.002'

Logsource:

• category: image_load
• product: windows

Detection:
  selection:
    Image|endswith: '\outlook.exe'
    ImageLoaded|endswith: '\outlvba.dll'
  condition:selection
Falsepositives:
  -Legitimate macro usage. Add the appropriate filter according to your environment
Level: medium