outlook.exe

Microsoft Outlook file version info (xCyclopedia)

LOLBAS Download 1 Sigma rule name it 1 ATT&CK technique 1 documented command 1 known copy with hashes

How outlook.exe is abused

documented by LOLBAS

Download T1105 Ingress Tool Transfer

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for outlook.exe.

1 documented command

from LOLBAS, each read by the identifier

Download T1105 Ingress Tool Transfer User privileges

Downloads payload from remote server

Outlook.exe {REMOTEURL}

Identify

The command the identifier reads trips no Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for outlook.exe, by Nir Chako, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for outlook.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highRenamed Office Binary ExecutionNasreddine Bencherchali (Nextron Systems)

T1105Ingress Tool Transfer

Is it the real outlook.exe?

file version info and known copies

Installed inC:\Program Files (x86)\Microsoft Office\root\Office16\

Signed byMicrosoft Corporation

ProductMicrosoft Outlook, Microsoft Corporation

DescriptionMicrosoft Outlook

1 known copy

16.0.12527.20482 · C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE · signed by Microsoft Corporation

326f909470f562f20f0e66fefe8c9936c0cf0269d0c87d107120c5e2ac06b9b5

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.