Detection: Detect Outlook exe writing a zip file

Updated Date: 2026-01-23 ID: a51bfe1a-94f0-4822-b1e4-16ae10145893 Author: Bhavin Patel, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic identifies the execution of outlook.exe writing a .zip file to the disk. It leverages data from the Endpoint data model, specifically monitoring process and filesystem activities. This behavior can be significant as it may indicate the use of Outlook to deliver malicious payloads or exfiltrate data via compressed files. If confirmed malicious, this activity could lead to unauthorized data access, data exfiltration, or the delivery of malware, potentially compromising the security of the affected system and network.

Search

 1
 2| tstats `security_content_summariesonly`
 3  min(_time) as firstTime
 4  max(_time) as lastTime
 5
 6FROM datamodel=Endpoint.Processes where
 7
 8Processes.process_name=outlook.exe
 9
10by _time span=5m
11  Processes.action Processes.dest Processes.original_file_name
12  Processes.parent_process Processes.parent_process_exec
13  Processes.parent_process_guid Processes.parent_process_id
14  Processes.parent_process_name Processes.parent_process_path
15  Processes.process Processes.process_exec Processes.process_guid
16  Processes.process_hash Processes.process_id Processes.process_integrity_level
17  Processes.process_name Processes.process_path
18  Processes.user Processes.user_id Processes.vendor_product
19
20
21| `drop_dm_object_name(Processes)`
22
23| `security_content_ctime(firstTime)`
24
25| `security_content_ctime(lastTime)`
26
27
28| rename process_guid as malicious_id
29
30| rename parent_process_id as outlook_id
31
32
33| join malicious_id type=inner
34  [
35    
36| tstats `security_content_summariesonly`
37      count values(Filesystem.file_path) as file_path
38            values(Filesystem.file_name) as file_name
39      FROM datamodel=Endpoint.Filesystem where
40
41      Filesystem.file_path=*.zip
42      Filesystem.file_path IN ("*:\\Users*", "*\\AppData\\Local\\Temp*")
43      Filesystem.action=created
44
45      by _time span=5m
46         Filesystem.process_guid Filesystem.process_id
47         Filesystem.file_hash Filesystem.dest Filesystem.dvc
48         Filesystem.signature Filesystem.signature_id
49
50    
51| `drop_dm_object_name(Filesystem)`
52    
53| `security_content_ctime(firstTime)`
54    
55| `security_content_ctime(lastTime)`
56
57    
58| rename process_guid as malicious_id
59
60    
61| fields malicious_id outlook_id dest
62             file_path file_name
63             file_hash count file_id
64  ]
65
66| table firstTime lastTime user malicious_id outlook_id
67        process_name parent_process_name file_name file_path
68        dest action original_file_name parent_process
69        parent_process_name parent_process_exec parent_process_guid
70        parent_process_id parent_process_path process_exec
71        process_guid process_hash process_id process_integrity_level
72        process_name process_path user user_id vendor_product
73
74
75| where file_name != ""
76
77| `detect_outlook_exe_writing_a_zip_file_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 1	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'`
Sysmon EventID 11	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
detect_outlook_exe_writing_a_zip_file_filter	`search *`

detect_outlook_exe_writing_a_zip_file_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1566.001	Spearphishing Attachment	Initial Access

Delivery

DE.AE

CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Risk Event	True

This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.

Implementation

You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon.

Known False Positives

It is not uncommon for outlook to write legitimate zip files to the disk.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message:

ZIP file - [$file_name$] located in [$file_path$] written by outlook.exe on destination host - [$dest$] by user - [$user$]

Risk Object	Risk Object Type	Risk Score	Threat Objects
user	user	25	file_name, file_path
dest	system	25	file_name, file_path

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 15