Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting

Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module

ATT&CK coverage

Outside the enterprise matrix

T1008
T1137
T1546

Detection requirements

Log source product: windows
Log source category: registry_set

What the source says

What fires this without an attack behind it

Unknown

References

https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53
https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/

Tagged by the source as

attack.command-and-controlattack.persistenceattack.privilege-escalation

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.