Malicious Outlook Rule Created via Exchange Web Services

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects the creation of malicious Outlook rules via Exchange Web Services (EWS). It specifically looks for HTTP traffic to '/EWS/Exchange.asmx' containing the 'CreateRule' string in the client body, indicating an attempt to establish persistence within an Outlook environment.