Windows Registry Changes for Outlook WebView Home Page URL Persistence

title: Windows Registry Changes for Outlook WebView Home Page URL Persistence
id: d26988c8-4166-42d2-81b7-6e7b357aedf3
related:
  - id: 487bb375-12ef-41f6-baae-c6a1572b4dd1
    type: similar
  - id: ddd171b5-2cc6-4975-9e78-f0eccd08cc76
    type: derived
status: test
description: This rule flags registry set events where the TargetObject path indicates Outlook WebView home page configuration under Microsoft Office. Attackers may abuse the Outlook home page setting to establish persistence by changing the WebView URL configuration. It relies on Windows registry write telemetry that includes the TargetObject path being written.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=70
  - https://support.microsoft.com/en-us/topic/outlook-home-page-feature-is-missing-in-folder-properties-d207edb7-aa02-46c5-b608-5d9dbed9bd04?ui=en-us&rs=en-us&ad=us
  - https://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_outlook_homepage.yml
author: Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand, Huntrule Team
date: 2021-06-09
modified: 2024-08-07
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains|all:
      - \Software\Microsoft\Office\
      - \Outlook\WebView\
    TargetObject|endswith: \URL
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1