As long as Outlook is open and authenticated on the target machine, we can piggy back on the already open and authenticated session without requiring credentials. If the target logs into a different workstation, the rules will automatically be downloaded and will execute on the new machine, facilitating lateral movement. The rules are stored on the Exchange server and are designed to sync with all Outlook clients. If we can create an Outlook rule that executes a payload, that's triggered by an email that we send, we will be able to trigger the execution of a payload on the target machine just by sending an email. Another action that can be set is running an application, which presents an interesting situation. For example, assigning a category to all emails from your dev team or flagging emails if they contain the keyword 'important' in the subject. Setting a rule in Outlook allows actions to be performed on incoming or outgoing emails, if a predetermined condition is met. Their research is highly recommended reading also.

Great minds think alike! It is interesting to see how this problem was approached and solved in different ways. Sensepost also published similar tooling on 1st September 2016. Luke succeeded in creating a tool that can do this and you can download it here:, but do please read on to learn more about the tool and the approach Luke took to this project. These posts provide context for this research and it is advisable to read the Silent Break Security post by Nick Landers before proceeding. Prior research also exists that was published in 20. In the blog post he discussed a persistence mechanism via the use of Outlook rules.

In December 2015, Nick Landers ( ) from Silent Break Security published a blog post titled 'Malicous Outlook Rules' ( ). This was the task given to Luke Roberts (an MWR intern) as a research project. We thought it would be far more convenient and useful to be able to programmatically create such rules, from a shell or implant. The process of creating a malicious Outlook rule currently requires interactive GUI access on a compromised system or possession of credentials as well as the ability to interact directly to the exchange server from an attacker owned host.

Outlook 2016 rules location