Threat intelligence / Technique

Outlook Forms

Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system. Outlook forms are used as templates for presentation and functionality in Outlook messages. Custom Outlook forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.(Citation: SensePost Outlook Forms) Once malicious forms have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious forms will execute when an adversary sends a specifically crafted email to the user.(Citation: SensePost Outlook Forms)

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system. Outlook forms are used as templates for presentation and functionality in Outlook messages. Custom Outlook forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.(Citation: SensePost Outlook Forms) Once malicious forms have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious forms will execute when an adversary sends a specifically crafted email to the user.(Citation: SensePost Outlook Forms)

4 recorded

Relationships

mitigates

from Behavior Prevention on Endpoint

Mitigation

mitigates

from Update Software

Mitigation

subtechnique-of

to Office Application Startup

Technique

uses

from Ruler

Tool

4 external

References

mitre-attack

T1137.003

Microsoft Detect Outlook Forms

https://docs.microsoft.com/en-us/office365/securitycompliance/detect-and-remediate-outlook-rules-forms-attack

SensePost NotRuler

https://github.com/sensepost/notruler

SensePost Outlook Forms

https://sensepost.com/blog/2017/outlook-forms-and-shells/