Windows Registry Changes for Outlook Task/Note Reminder Trigger

Flags Windows registry writes under Outlook task/note keys consistent with an Outlook reminder being triggered.

FreeUnreviewedSigmalowv1

windows-registry-changes-for-outlook-task-note-reminder-trigger-fc06e655

title: Windows Registry Changes for Outlook Task/Note Reminder Trigger
id: b8f952c3-affe-4a21-aacc-8efb14e3916a
status: test
description: This rule matches registry set events affecting Microsoft Office Outlook paths containing the Tasks or Notes subkeys, indicating that an Outlook reminder was recorded for a task or note. Attackers may abuse Outlook data persistence to trigger user notifications or interactions, making these changes relevant for investigation. The detection relies on Windows registry modification telemetry focused on the specific registry key paths present in the event.
references:
  - https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-23397/registry_set_exploit_cve_2023_23397_outlook_reminder_trigger.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-05
modified: 2023-08-17
tags:
  - attack.persistence
  - attack.t1137
  - cve.2023-23397
  - detection.emerging-threats
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains|all:
      - \SOFTWARE\Microsoft\Office\
      - \Outlook\
    TargetObject|contains:
      - \Tasks\
      - \Notes\
  condition: selection
falsepositives:
  - Legitimate reminders received for a task or a note will also trigger this rule.
level: low
license: DRL-1.1
related:
  - id: fc06e655-d98c-412f-ac76-05c2698b1cb2
    type: derived

What it detects

This rule matches registry set events affecting Microsoft Office Outlook paths containing the Tasks or Notes subkeys, indicating that an Outlook reminder was recorded for a task or note. Attackers may abuse Outlook data persistence to trigger user notifications or interactions, making these changes relevant for investigation. The detection relies on Windows registry modification telemetry focused on the specific registry key paths present in the event.

Known false positives

Legitimate reminders received for a task or a note will also trigger this rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.