Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11 detections
Filters
Last updated
All Time
Detection languages
6
3
1
1
Contributors
5
3
2
1
Categories
5
3
3
2
2
Platforms
10
2
1
1
Products / Services
4
3
1
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
1
IDS Protocols
1
The following analytic identifies modifications to specific Outlook registry values related to WebView and Today features. It detects when a URL is set in these registry locations, which could indicate attempts to manipulate Outlook's web-based components. The analytic focuses on changes to the "URL" value within Outlook's WebView and Today registry paths. This activity is significant as it may represent an attacker's effort to redirect Outlook's web content or inject malicious URLs. If successful, this technique could lead to phishing attempts, data theft, or serve as a stepping stone for further compromise of the user's email client and potentially sensitive information.
Detects injection of malicious URLs into Outlook folder home page property for persistence
This rule detects attempts to inject a malicious URL into the Outlook Home Page setting for persistence. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "HomePageURL" and "http" (case-insensitive) in the file data, indicating a potential attempt to modify Outlook's home page setting to point to an attacker-controlled URL.
Detects potential persistence activity via Outlook Home Page by monitoring modifications to specific registry keys. An attacker can set a home page URL in Outlook's WebView registry keys to achieve code execution and persistence when a user opens a folder in Outlook.
This rule detects potential persistence activity by monitoring modifications to the Outlook Today page settings in the Windows Registry. Attackers can leverage this feature by setting a custom URL in the registry keys `Software\Microsoft\Office\<version>\Outlook\Today\URL` or `Software\Microsoft\Office\<version>\Outlook\Today\UserDefinedUrl`, along with setting the `Stamp` value to `0x00000001`. This allows for the execution of arbitrary code when Outlook is opened, providing a persistent foothold on the system.
KQL Query from file: Global Admin Entra Cookie with Chrome ZeroDay
KQL Query
KQL Query from file: Detect & mitigate potential Specula Exploitation
KQL Query
KQL Query from file: CVE-2025-4664 Chrome flaw with public exploit
Detects changes to registry values related to Outlook security settings, which could indicate an attempt to modify Outlook's behavior for persistence or other malicious purposes. This rule specifically looks for modifications within the 'SOFTWARE\Microsoft\Office\<version>\Outlook\Security\' registry path.