attack.t1137

Detects changes to the registry values related to outlook that indicates that a reminder was triggered for a Note or Task item. This could be a sign of exploitation of CVE-2023-23397. Further investigation is required to determine the success of an exploitation.

Potential Persistence Via Microsoft Office Startup Folder

Aug 12, 2024 · attack.persistence attack.t1137 ·

Share on:

Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.

Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·

Share on:

Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module

Registry Modification to Hidden File Extension

Aug 12, 2024 · attack.persistence attack.t1137 ·

Share on:

Hides the file extension through modification of the registry

Suspicious Outlook Macro Created

Aug 12, 2024 · attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·

Share on:

Detects the creation of a macro file for Outlook.