Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system. Outlook forms are used as templates for presentation and functionality in Outlook messages. Custom Outlook forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.(Citation: SensePost Outlook Forms)

Once malicious forms have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious forms will execute when an adversary sends a specifically crafted email to the user.(Citation: SensePost Outlook Forms)
Outlook Forms
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1137/003  external_id: T1137.003     source_name: SensePost Outlook Forms  description: Stalmans, E. (2017, April 28). Outlook Forms and Shells. Retrieved February 4, 2019.  url: https://sensepost.com/blog/2017/outlook-forms-and-shells/     source_name: Microsoft Detect Outlook Forms  description: Fox, C., Vangel, D. (2018, April 22). Detect and Remediate Outlook Rules and Custom Forms Injections Attacks in Office 365. Retrieved February 4, 2019.  url: https://docs.microsoft.com/en-us/office365/securitycompliance/detect-and-remediate-outlook-rules-forms-attack     source_name: SensePost NotRuler  description: SensePost. (2017, September 21). NotRuler - The opposite of Ruler, provides blue teams with the ability to detect Ruler usage against Exchange. Retrieved February 4, 2019.  url: https://github.com/sensepost/notruler     