Outlook EnableUnsafeClientMailRules Setting Enabled via Registry

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•24

Detects an attacker trying to enable the Outlook security setting "EnableUnsafeClientMailRules" which allows Outlook to run applications or execute macros. This can be used for persistence or defense evasion.