Potential Persistence Via Outlook Today Page
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects potential persistence activity via outlook today page. An attacker can set a custom page to execute arbitrary code and link to it via the registry values "URL" and "UserDefinedUrl".
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Registry value modified" AND ((OBJECTNAME contains "Software\Microsoft\Office" AND OBJECTNAME contains "\Outlook\Today") OR ((OBJECTNAME endswith "Software\Microsoft\Office" AND isExist(OBJECTVALUENAME)) OR (OBJECTNAME endswith "\Outlook\Today" AND isExist(OBJECTVALUENAME)))) AND ((OBJECTNAME endswith "\Stamp" AND (INFORMATION = "DWORD (0x00000001)" OR (CHANGES = 1 AND NEWTYPE = "REG_DWORD"))) OR OBJECTNAME endswith "\URL,\UserDefinedUrl") AND (PROCESSNAME notstartswith "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\,C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates" OR PROCESSNAME notendswith "\OfficeClickToRun.exe") select Action1.HOSTNAME,Action1.MESSAGE,Action1.OBJECTNAME,Action1.PROCESSNAME,Action1.PREVVAL,Action1.CHANGES
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand
