Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•0•1

Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module