Ruler — Malware Profile

Ruler is a tool to abuse Microsoft Exchange services. It is publicly available on GitHub and the tool is executed via the command line. The creators of Ruler have also released a defensive tool, NotRuler, to detect its usage.

MITRE ATT&CK techniques (4)

• T1087.003 Email Account
• T1137.003 Outlook Forms
• T1137.004 Outlook Home Page
• T1137.005 Outlook Rules

Attributed threat actors

• APT33

Read the full analysis on IntelFusions