Windows Registry: Outlook EnableUnsafeClientMailRules Set to 1
Alerts when Outlook’s EnableUnsafeClientMailRules registry value is enabled (DWORD 0x1), reducing mailbox macro/script protections.
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-02-08
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags changes in the Windows registry where Outlook’s EnableUnsafeClientMailRules value is set to DWORD 0x00000001 under the Outlook\Security path. Enabling this setting reduces Outlook security controls, allowing client mail rules to start applications or execute macros. It relies on registry set telemetry that records the TargetObject ending with \Outlook\Security\EnableUnsafeClientMailRules and the written value.
Reporting behind it
- support.microsoft.comhttps://support.microsoft.com/en-us/topic/how-to-control-the-rule-actions-to-start-an-application-or-run-a-macro-in-outlook-2016-and-outlook-2013-e4964b72-173c-959d-5d7b-ead562979048
- speakerdeck.comhttps://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=44
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_office_outlook_enable_unsafe_client_mail_rules.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: Outlook EnableUnsafeClientMailRules Set to 1"
id: 65e565fb-7008-439f-853c-3931d55bbc50
related:
- id: c3cefdf4-6703-4e1c-bad8-bf422fc5015a
type: similar
- id: 55f0a3a1-846e-40eb-8273-677371b8d912
type: similar
- id: 6763c6c8-bd01-4687-bc8d-4fa52cf8ba08
type: derived
status: test
description: This rule flags changes in the Windows registry where Outlook’s EnableUnsafeClientMailRules value is set to DWORD 0x00000001 under the Outlook\Security path. Enabling this setting reduces Outlook security controls, allowing client mail rules to start applications or execute macros. It relies on registry set telemetry that records the TargetObject ending with \Outlook\Security\EnableUnsafeClientMailRules and the written value.
references:
- https://support.microsoft.com/en-us/topic/how-to-control-the-rule-actions-to-start-an-application-or-run-a-macro-in-outlook-2016-and-outlook-2013-e4964b72-173c-959d-5d7b-ead562979048
- https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=44
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_office_outlook_enable_unsafe_client_mail_rules.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-08
modified: 2023-08-17
tags:
- attack.persistence
- attack.defense-impairment
- attack.t1112
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|endswith: \Outlook\Security\EnableUnsafeClientMailRules
Details: DWORD (0x00000001)
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1