Malicious Outlook Form Script Delivered

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects the delivery of a malicious Outlook form script over HTTP. It specifically looks for HTTP traffic flowing to the client that contains the strings "IPM.Note", "Script", and "VBScript" within the file data, indicating an attempt to deliver a VBScript-based Outlook form.