Windows Registry: Outlook Macro Security Level Set to Enable All Macros

title: "Windows Registry: Outlook Macro Security Level Set to Enable All Macros"
id: 4461dff5-1aed-4fa0-85a8-b0986ddf36a7
status: test
description: This rule flags registry changes to the Outlook security level key when the setting value indicates that all macros are enabled without warning. Disabling macro prompts can help attackers execute malicious Office macros with reduced user interaction. The detection relies on registry set telemetry, specifically matching the target Outlook security level path and the macro security value.
references:
  - https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_office_outlook_enable_macro_execution.yml
author: "@ScoubiMtl, Huntrule Team"
date: 2021-04-05
modified: 2023-08-17
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.command-and-control
  - attack.t1137
  - attack.t1008
  - attack.t1546
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: \Outlook\Security\Level
    Details|contains: "0x00000001"
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: e3b50fa5-3c3f-444e-937b-0a99d33731cd
    type: derived