Outlook EnableUnsafeClientMailRules Setting Enabled via Command Line

SigmaHQ Detections@sigmaHQ

•updated May 20, 2025•0•20

Detects an attacker trying to enable the Outlook security setting "EnableUnsafeClientMailRules" which allows Outlook to run applications or execute macros. This setting can be manipulated via the command line, typically through registry modification commands.