Windows Registry Set—Custom Outlook Today Page for Persistence
Flags registry writes that configure a custom Outlook Today URL using Outlook Today registry values.
- Product
- windows
- Category
- registry_set
- Author
- Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand (SigmaHQ), DRL 1.1
- Published
- 2021-06-10
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies registry changes under the Office Outlook Today location that indicate a custom “Today” page may be configured for persistence. Attackers can use registry values such as URL and UserDefinedUrl (and a Stamp flag) to point Outlook Today to an attacker-controlled or arbitrary web page. It relies on Windows registry_set telemetry, matching TargetObject paths and value name/suffix patterns while excluding events tied to ClickToRun installation executables.
Reporting behind it
- speakerdeck.comhttps://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=74
- trustedsec.comhttps://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_outlook_todaypage.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry Set—Custom Outlook Today Page for Persistence
id: 5586bd25-baf3-426e-9002-cf6f2d61cd1a
related:
- id: ddd171b5-2cc6-4975-9e78-f0eccd08cc76
type: similar
- id: 487bb375-12ef-41f6-baae-c6a1572b4dd1
type: derived
status: test
description: This rule identifies registry changes under the Office Outlook Today location that indicate a custom “Today” page may be configured for persistence. Attackers can use registry values such as URL and UserDefinedUrl (and a Stamp flag) to point Outlook Today to an attacker-controlled or arbitrary web page. It relies on Windows registry_set telemetry, matching TargetObject paths and value name/suffix patterns while excluding events tied to ClickToRun installation executables.
references:
- https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=74
- https://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_outlook_todaypage.yml
author: Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand, Huntrule Team
date: 2021-06-10
modified: 2024-08-07
tags:
- attack.persistence
- attack.defense-impairment
- attack.t1112
logsource:
product: windows
category: registry_set
detection:
selection_main:
TargetObject|contains|all:
- Software\Microsoft\Office\
- \Outlook\Today\
selection_value_stamp:
TargetObject|endswith: \Stamp
Details: DWORD (0x00000001)
selection_value_url:
TargetObject|endswith:
- \URL
- \UserDefinedUrl
filter_main_office:
Image|startswith:
- C:\Program Files\Common Files\Microsoft Shared\ClickToRun\
- C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\
Image|endswith: \OfficeClickToRun.exe
condition: selection_main and 1 of selection_value_* and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1