Malicious Outlook Rule without an EXE

This write-up demonstrates an email-based technique to achieve remote code execution and C2 by leveraging Outlook rules to download and execute a VBE file that runs an encoded PowerShell Meterpreter reverse shell. The author details bypassing EXE download restrictions, AV detection of an autogenerated VBS payload, and a manually crafted VBScript that successfully launches a hidden PowerShell session to connect to an attacker-controlled server.