Windows Registry Changes to Outlook Security Settings
Alerts on registry updates to Outlook security configuration keys on Windows, excluding direct Outlook.exe changes.
- Product
- windows
- Category
- registry_set
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-12-28
- Updated
- 2026-07-30
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags modifications to Windows registry values under the Microsoft Office Outlook security settings path. Attackers may change these settings to weaken email handling or security controls, enabling further persistence or easier delivery of malicious content. The detection relies on registry set events and matches target registry paths containing both the Office and Outlook\Security subkeys while excluding updates performed by Outlook.EXE from the Office installation directories.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1137/T1137.md
- learn.microsoft.comhttps://learn.microsoft.com/en-us/outlook/troubleshoot/security/information-about-email-security-settings
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_office_outlook_security_settings.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry Changes to Outlook Security Settings
id: d0cfb15a-f48c-418f-9be6-25c42d2b54ce
related:
- id: 6763c6c8-bd01-4687-bc8d-4fa52cf8ba08
type: similar
- id: c3cefdf4-6703-4e1c-bad8-bf422fc5015a
type: derived
status: test
description: This rule flags modifications to Windows registry values under the Microsoft Office Outlook security settings path. Attackers may change these settings to weaken email handling or security controls, enabling further persistence or easier delivery of malicious content. The detection relies on registry set events and matches target registry paths containing both the Office and Outlook\Security subkeys while excluding updates performed by Outlook.EXE from the Office installation directories.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1137/T1137.md
- https://learn.microsoft.com/en-us/outlook/troubleshoot/security/information-about-email-security-settings
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_office_outlook_security_settings.yml
author: frack113, Huntrule Team
date: 2021-12-28
modified: 2026-01-09
tags:
- attack.persistence
- attack.t1137
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains|all:
- \SOFTWARE\Microsoft\Office\
- \Outlook\Security\
filter_main_outlook:
Image|startswith:
- C:\Program Files\Microsoft Office\
- C:\Program Files (x86)\Microsoft Office\
Image|endswith: \OUTLOOK.EXE
condition: selection and not 1 of filter_main_*
falsepositives:
- Administrative activity
level: medium
license: DRL-1.1