huntrule

Windows Registry: Outlook Macro Security Level Set to Enable All Macros

Detects Outlook macro warning bypass by setting the Outlook security level registry value to enable all macros.

FreeReviewedSigma · High · v1
Product
windows
Category
registry_set
Author
@ScoubiMtl (SigmaHQ), DRL 1.1
Published
2021-04-05
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Persistence → C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags registry changes to the Outlook security level key when the setting value indicates that all macros are enabled without warning. Disabling macro prompts can help attackers execute malicious Office macros with reduced user interaction. The detection relies on registry set telemetry, specifically matching the target Outlook security level path and the macro security value.

Reporting behind it

Related detections9 linkedT1546 — drag to rearrange
Windows: Suspicious Outlook VbaProject.OTM Macro File Created
Windows Persistence: Outlook LoadMacroProviderOnBoot Registry Setting Modification
Windows: New Outlook VBAProject OTM Macro File Created
Suspicious Python Path Configuration Hook Persistence (via file_event)
Suspicious Zsh Persistence via zshrc_aliases Appended to Shell Startup (via process_creation)
Malicious UNC4841 Dropper Deployment to Boot Partition via mknod (via process_creation)
Suspicious NetworkManager Dispatcher Script Persistence
Suspicious APT Or YUM Package Manager Hook Configuration Created
Suspicious Office Application Spawning Mshta With Remote HTA
Windows Registry: Outlook Macro Security Level Set to Enable All Macros
Pivot detection · T1546 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.