Windows Registry Changes to Outlook Security Settings

Alerts on registry updates to Outlook security configuration keys on Windows, excluding direct Outlook.exe changes.

FreeUnreviewedSigmamediumv1

windows-registry-changes-to-outlook-security-settings-c3cefdf4

title: Windows Registry Changes to Outlook Security Settings
id: d0cfb15a-f48c-418f-9be6-25c42d2b54ce
related:
  - id: 6763c6c8-bd01-4687-bc8d-4fa52cf8ba08
    type: similar
  - id: c3cefdf4-6703-4e1c-bad8-bf422fc5015a
    type: derived
status: test
description: This rule flags modifications to Windows registry values under the Microsoft Office Outlook security settings path. Attackers may change these settings to weaken email handling or security controls, enabling further persistence or easier delivery of malicious content. The detection relies on registry set events and matches target registry paths containing both the Office and Outlook\Security subkeys while excluding updates performed by Outlook.EXE from the Office installation directories.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1137/T1137.md
  - https://learn.microsoft.com/en-us/outlook/troubleshoot/security/information-about-email-security-settings
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_office_outlook_security_settings.yml
author: frack113, Huntrule Team
date: 2021-12-28
modified: 2026-01-09
tags:
  - attack.persistence
  - attack.t1137
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains|all:
      - \SOFTWARE\Microsoft\Office\
      - \Outlook\Security\
  filter_main_outlook:
    Image|startswith:
      - C:\Program Files\Microsoft Office\
      - C:\Program Files (x86)\Microsoft Office\
    Image|endswith: \OUTLOOK.EXE
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Administrative activity
level: medium
license: DRL-1.1

What it detects

This rule flags modifications to Windows registry values under the Microsoft Office Outlook security settings path. Attackers may change these settings to weaken email handling or security controls, enabling further persistence or easier delivery of malicious content. The detection relies on registry set events and matches target registry paths containing both the Office and Outlook\Security subkeys while excluding updates performed by Outlook.EXE from the Office installation directories.

Known false positives

Administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.