Potential Persistence Via Outlook Today Page

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•1

Detects potential persistence activity via outlook today page. An attacker can set a custom page to execute arbitrary code and link to it via the registry values "URL" and "UserDefinedUrl".