Sunturai
Back to results
MediumSplunk security contentRaven Tait +1

Windows Outlook Macro Security Modified

The following analytic detects the modification of the Windows Registry key "Level" under Outlook Security. This allows macros to execute without warning, which could allow malicious scripts to run without notice.…

Description

The following analytic detects the modification of the Windows Registry key "Level" under Outlook Security. This allows macros to execute without warning, which could allow malicious scripts to run without notice. This detection leverages data from the Endpoint.Registry datamodel, specifically looking for the registry value name "Level" with a value of "0x00000001". This activity is significant as it is commonly associated with some malware infections, indicating potential malicious intent to harvest email information.

Detection logic

Detection requirements

Platform
ESXiLinuxmacOSOffice SuiteWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source category
sysmon_eventid_13

Known benign triggers

  • It is unusual to modify this feature on a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice