Outlook Macro Execution Without Warning Setting Enabled

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

Detects when the Microsoft Outlook security setting for macro execution is modified to allow macros to run without warning. This change can enable malicious macros to execute automatically, potentially leading to persistence, privilege escalation, or further compromise.