huntrule

Windows Registry Set—Custom Outlook Today Page for Persistence

Flags registry writes that configure a custom Outlook Today URL using Outlook Today registry values.

FreeUnreviewedSigmahighv1
title: Windows Registry Set—Custom Outlook Today Page for Persistence
id: 5586bd25-baf3-426e-9002-cf6f2d61cd1a
related:
  - id: ddd171b5-2cc6-4975-9e78-f0eccd08cc76
    type: similar
  - id: 487bb375-12ef-41f6-baae-c6a1572b4dd1
    type: derived
status: test
description: This rule identifies registry changes under the Office Outlook Today location that indicate a custom “Today” page may be configured for persistence. Attackers can use registry values such as URL and UserDefinedUrl (and a Stamp flag) to point Outlook Today to an attacker-controlled or arbitrary web page. It relies on Windows registry_set telemetry, matching TargetObject paths and value name/suffix patterns while excluding events tied to ClickToRun installation executables.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=74
  - https://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_outlook_todaypage.yml
author: Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand, Huntrule Team
date: 2021-06-10
modified: 2024-08-07
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  product: windows
  category: registry_set
detection:
  selection_main:
    TargetObject|contains|all:
      - Software\Microsoft\Office\
      - \Outlook\Today\
  selection_value_stamp:
    TargetObject|endswith: \Stamp
    Details: DWORD (0x00000001)
  selection_value_url:
    TargetObject|endswith:
      - \URL
      - \UserDefinedUrl
  filter_main_office:
    Image|startswith:
      - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\
      - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\
    Image|endswith: \OfficeClickToRun.exe
  condition: selection_main and 1 of selection_value_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule identifies registry changes under the Office Outlook Today location that indicate a custom “Today” page may be configured for persistence. Attackers can use registry values such as URL and UserDefinedUrl (and a Stamp flag) to point Outlook Today to an attacker-controlled or arbitrary web page. It relies on Windows registry_set telemetry, matching TargetObject paths and value name/suffix patterns while excluding events tied to ClickToRun installation executables.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.