Outlook Forms and Shells

This report explains a technique for achieving code execution and persistence in Microsoft Outlook by leveraging custom Outlook forms that execute VBScript, and describes how the Ruler tool automates creating, publishing, and triggering these forms via Exchange/MAPI. It details storage in the folder-associated items table, synchronization across Outlook instances, multiple trigger events (open/read/reply/forward), stealth options, and remote re-triggering via specially classed emails. The write-up notes that disabling macros does not prevent this VBScript execution and recommends monitoring/logging VBScript activity and using MFA, while acknowledging limited straightforward mitigations.