Windows Outlook WebView Registry Modification

The following analytic identifies modifications to specific Outlook registry values related to WebView and Today features. It detects when a URL is set in these registry locations, which could indicate attempts to manipulate Outlook's web-based components. The analytic focuses on changes to the "URL" value within Outlook's WebView and Today registry paths. This activity is significant as it may represent an attacker's effort to redirect Outlook's web content or inject malicious URLs. If successful, this technique could lead to phishing attempts, data theft, or serve as a stepping stone for further compromise of the user's email client and potentially sensitive information.

ATT&CK coverage

Outside the enterprise matrix

T1112Modify Registry 198 detections cover this technique

Detection requirements

Log source category: sysmon_eventid_13

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.

Sign in to read it Create an account

Detection catalogue

ATT&CK coverage

Detection requirements

Detection logic