Date: 08/08/2024
Severity: High
Summary
Detects potential persistent activity through the Outlook home page. An attacker might set a home page to enable code execution and maintain persistence by modifying the WebView registry keys.
Indicators of Compromise (IOC) List
TargetObject | \Software\Microsoft\Office\ \Outlook\WebView\ \URL |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 | (resourceName = "Sysmon" AND eventtype = "13" ) AND targetobject in ("\\Software\\Microsoft\\Office" , "\\Outlook\\WebView" , "\\URL") |
Detection Query 2 | (technologygroup = "EDR" ) AND targetobject in ("\\Software\\Microsoft\\Office" , "\\Outlook\\WebView" , "\\URL") |
Reference:
Sigma Detection Rule for Outlook Homepage Registry Persistence
Hunting for Persistence Through Microsoft Exchange Server and Outlook
Microsoft Support on the Missing Outlook Homepage Feature
TrustedSec Analysis of Specula and Outlook Registry-Based Command and Control