Windows Persistence: Outlook LoadMacroProviderOnBoot Registry Setting Modification
Alerts on enabling the Outlook LoadMacroProviderOnBoot registry setting, which can allow automatic VBA module loading at startup.
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-04-05
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → C2Recon
Resource Dev
Initial Access
Execution
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags registry changes to the Outlook setting LoadMacroProviderOnBoot when the value indicates it is enabled (0x00000001). If set to allow macro provider loading on boot, it can give attackers a way to automatically load a configured VBA project or module without user interaction. The detection relies on Windows registry set telemetry capturing changes to the target Outlook registry path and value contents.
Reporting behind it
- speakerdeck.comhttps://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53
- linkedin.comhttps://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_office_outlook_enable_load_macro_provider_on_boot.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Persistence: Outlook LoadMacroProviderOnBoot Registry Setting Modification"
id: 98f0ec1a-289f-4188-b6c3-9219f4891927
status: test
description: This rule flags registry changes to the Outlook setting LoadMacroProviderOnBoot when the value indicates it is enabled (0x00000001). If set to allow macro provider loading on boot, it can give attackers a way to automatically load a configured VBA project or module without user interaction. The detection relies on Windows registry set telemetry capturing changes to the target Outlook registry path and value contents.
references:
- https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53
- https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_office_outlook_enable_load_macro_provider_on_boot.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-04-05
modified: 2023-08-17
tags:
- attack.privilege-escalation
- attack.persistence
- attack.command-and-control
- attack.t1137
- attack.t1008
- attack.t1546
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|endswith: \Outlook\LoadMacroProviderOnBoot
Details|contains: "0x00000001"
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 396ae3eb-4174-4b9b-880e-dc0364d78a19
type: derived