Outlook Home Page URL Injection for Persistence

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects attempts to inject a malicious URL into the Outlook Home Page setting for persistence. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "HomePageURL" and "http" (case-insensitive) in the file data, indicating a potential attempt to modify Outlook's home page setting to point to an attacker-controlled URL.