Potential Persistence Via Outlook Home Page Registry Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•19

Detects potential persistence activity via Outlook Home Page by monitoring modifications to specific registry keys. An attacker can set a home page URL in Outlook's WebView registry keys to achieve code execution and persistence when a user opens a folder in Outlook.