---
id: 8201
title: "Malicious Outlook Rules"
source_domain: netspi.com
source_url: "https://www.netspi.com/blog/technical-blog/red-teaming/malicious-outlook-rules/"
published_at: "2015-12-04T00:00:00Z"
tags: ["phishing", "red-team", "powershell", "persistence", "exchange", "outlook-rules"]
phying_url: "https://phying.com/item/8201"
lang: en
---

# Malicious Outlook Rules

## Summary

Shows how stolen Exchange credentials can be weaponized through malicious Outlook rules that sync via Exchange and trigger a Start Application action, executing payloads without workstation access.

## Intelligence Metadata

- **Sources:** netspi.com
- **Published:** 2015-12-04T00:00:00Z
- **Original:** https://www.netspi.com/blog/technical-blog/red-teaming/malicious-outlook-rules/
- **Phying News:** https://phying.com/item/8201