
title: Persistent Outlook Landing Pages
author: Tobias Michalski
date: 2021/06/10
description: Detects the manipulation of persistent URLs which could execute malicious
  code
detection:
  SELECTION_1:
    EventID: 12
  SELECTION_2:
    EventID: 13
  SELECTION_3:
    EventID: 14
  SELECTION_4:
    TargetObject:
    - '*Software\Microsoft\Office\\*'
    - '*\Outlook\Today\\*'
  SELECTION_5:
    TargetObject: '*Stamp'
  SELECTION_6:
    Details: DWORD (0x00000001)
  SELECTION_7:
    TargetObject: '*UserDefinedUrl'
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and SELECTION_4 and ((SELECTION_5
    and SELECTION_6) or SELECTION_7))
falsepositives:
- unknown
fields:
- Details
id: 487bb375-12ef-41f6-baae-c6a1572b4dd1
level: high
logsource:
  category: registry_event
  product: windows
references:
- https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=70
status: experimental
tags:
- attack.persistence
- attack.t1112
ruletype: SIGMA
