Windows Registry Changes for Outlook Task/Note Reminder Trigger
Flags Windows registry writes under Outlook task/note keys consistent with an Outlook reminder being triggered.
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-05
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies registry changes under Microsoft Office/Outlook where the path includes Tasks or Notes, indicating that an Outlook reminder was received for a task or a note. Such events can be useful for spotting activity related to Outlook exploitation scenarios, where attackers may trigger reminder handling through specific inputs. It relies on Windows registry set telemetry for updates to TargetObject paths matching the specified Outlook keys.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry Changes for Outlook Task/Note Reminder Trigger
id: b8f952c3-affe-4a21-aacc-8efb14e3916a
status: test
description: This rule identifies registry changes under Microsoft Office/Outlook where the path includes Tasks or Notes, indicating that an Outlook reminder was received for a task or a note. Such events can be useful for spotting activity related to Outlook exploitation scenarios, where attackers may trigger reminder handling through specific inputs. It relies on Windows registry set telemetry for updates to TargetObject paths matching the specified Outlook keys.
references:
- https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-23397/registry_set_exploit_cve_2023_23397_outlook_reminder_trigger.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-05
modified: 2023-08-17
tags:
- attack.persistence
- attack.t1137
- cve.2023-23397
- detection.emerging-threats
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains|all:
- \SOFTWARE\Microsoft\Office\
- \Outlook\
TargetObject|contains:
- \Tasks\
- \Notes\
condition: selection
falsepositives:
- Legitimate reminders received for a task or a note will also trigger this rule.
level: low
license: DRL-1.1
related:
- id: fc06e655-d98c-412f-ac76-05c2698b1cb2
type: derived