Windows Persistence: Outlook LoadMacroProviderOnBoot Registry Setting Modification

title: "Windows Persistence: Outlook LoadMacroProviderOnBoot Registry Setting Modification"
id: 98f0ec1a-289f-4188-b6c3-9219f4891927
status: test
description: This rule flags registry changes to the Outlook setting LoadMacroProviderOnBoot when the value indicates it is enabled (0x00000001). If set to allow macro provider loading on boot, it can give attackers a way to automatically load a configured VBA project or module without user interaction. The detection relies on Windows registry set telemetry capturing changes to the target Outlook registry path and value contents.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53
  - https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_office_outlook_enable_load_macro_provider_on_boot.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-04-05
modified: 2023-08-17
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.command-and-control
  - attack.t1137
  - attack.t1008
  - attack.t1546
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: \Outlook\LoadMacroProviderOnBoot
    Details|contains: "0x00000001"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 396ae3eb-4174-4b9b-880e-dc0364d78a19
    type: derived