Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Potential Persistence Via Outlook Today Page

Detects potential persistence activity via outlook today page. An attacker can set a custom page to execute arbitrary code and link to it via the registry values "URL" and "UserDefinedUrl".

ATT&CK coverage

Persistence

T1112Modify RegistryAlso under Defense Impairment.199 detections cover this technique

Detection requirements

Log source product: windows
Log source category: registry_set

What the source says

What fires this without an attack behind it

Unknown

References

https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=74
https://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change

Tagged by the source as

attack.defense-impairmentattack.persistence

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.