Windows Registry: Outlook EnableUnsafeClientMailRules Set to 1

Alerts when Outlook’s EnableUnsafeClientMailRules registry value is enabled (DWORD 0x1), reducing mailbox macro/script protections.

FreeUnreviewedSigmahighv1

windows-registry-outlook-enableunsafeclientmailrules-set-to-1-6763c6c8

title: "Windows Registry: Outlook EnableUnsafeClientMailRules Set to 1"
id: 65e565fb-7008-439f-853c-3931d55bbc50
related:
  - id: c3cefdf4-6703-4e1c-bad8-bf422fc5015a
    type: similar
  - id: 55f0a3a1-846e-40eb-8273-677371b8d912
    type: similar
  - id: 6763c6c8-bd01-4687-bc8d-4fa52cf8ba08
    type: derived
status: test
description: This rule flags changes in the Windows registry where Outlook’s EnableUnsafeClientMailRules value is set to DWORD 0x00000001 under the Outlook\Security path. Enabling this setting reduces Outlook security controls, allowing client mail rules to start applications or execute macros. It relies on registry set telemetry that records the TargetObject ending with \Outlook\Security\EnableUnsafeClientMailRules and the written value.
references:
  - https://support.microsoft.com/en-us/topic/how-to-control-the-rule-actions-to-start-an-application-or-run-a-macro-in-outlook-2016-and-outlook-2013-e4964b72-173c-959d-5d7b-ead562979048
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=44
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_office_outlook_enable_unsafe_client_mail_rules.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-08
modified: 2023-08-17
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: \Outlook\Security\EnableUnsafeClientMailRules
    Details: DWORD (0x00000001)
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags changes in the Windows registry where Outlook’s EnableUnsafeClientMailRules value is set to DWORD 0x00000001 under the Outlook\Security path. Enabling this setting reduces Outlook security controls, allowing client mail rules to start applications or execute macros. It relies on registry set telemetry that records the TargetObject ending with \Outlook\Security\EnableUnsafeClientMailRules and the written value.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.