Windows Registry: Outlook Macro Security Level Set to Enable All Macros

Detects Outlook macro warning bypass by setting the Outlook security level registry value to enable all macros.

FreeReviewedSigma · High · v1

Product: windows
Category: registry_set
Author: @ScoubiMtl (SigmaHQ), DRL 1.1
Published: 2021-04-05
Updated: 2026-07-30

ATT&CK techniques

Persistence → C2

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1137Office Application Startup
- T1546Event Triggered Execution
Priv Esc
- T1546Event Triggered Execution
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1008Fallback Channels
Exfiltration
Impact

What it detects

This rule flags registry changes to the Outlook security level key when the setting value indicates that all macros are enabled without warning. Disabling macro prompts can help attackers execute malicious Office macros with reduced user interaction. The detection relies on registry set telemetry, specifically matching the target Outlook security level path and the macro security value.

Reporting behind it

Related detections9 linkedT1137 — drag to rearrange

Windows: Suspicious Outlook VbaProject.OTM Macro File Created

Windows Persistence: Outlook LoadMacroProviderOnBoot Registry Setting Modification

Windows: New Outlook VBAProject OTM Macro File Created

Suspicious Office Application Spawning Mshta With Remote HTA

AdminSDHolder Permissions Changed for Persistence (via security)

Malicious NotDoor Outlook VBA Persistence via VbaProject.OTM Deployment (via process_creation)

Malicious NotDoor Outlook Macro Auto-Execution Enablement via Registry (via registry_set)

Suspicious Persistence via Shell Script Dropped in profile.d Directory (via file_event)

Office Persistence via WLL Add-in Dropped to Word STARTUP Folder

Windows Registry: Outlook Macro Security Level Set to Enable All Macros

Pivot detection · T1137 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-registry-outlook-macro-security-level-set-to-enable-all-macros-e3b50fa5

title: "Windows Registry: Outlook Macro Security Level Set to Enable All Macros"
id: 4461dff5-1aed-4fa0-85a8-b0986ddf36a7
status: test
description: This rule flags registry changes to the Outlook security level key when the setting value indicates that all macros are enabled without warning. Disabling macro prompts can help attackers execute malicious Office macros with reduced user interaction. The detection relies on registry set telemetry, specifically matching the target Outlook security level path and the macro security value.
references:
  - https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_office_outlook_enable_macro_execution.yml
author: "@ScoubiMtl, Huntrule Team"
date: 2021-04-05
modified: 2023-08-17
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.command-and-control
  - attack.t1137
  - attack.t1008
  - attack.t1546
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: \Outlook\Security\Level
    Details|contains: "0x00000001"
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: e3b50fa5-3c3f-444e-937b-0a99d33731cd
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL