Hide Navigation Hide TOC

Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting (396ae3eb-4174-4b9b-880e-dc0364d78a19)

Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Fallback Channels - T1008 (f24faf46-3b26-4dbb-98f2-63460498e433)	Attack Pattern	Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting (396ae3eb-4174-4b9b-880e-dc0364d78a19)	Sigma-Rules	1
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting (396ae3eb-4174-4b9b-880e-dc0364d78a19)	Sigma-Rules	Event Triggered Execution - T1546 (b6301b64-ef57-4cce-bb0b-77026f14a8db)	Attack Pattern	1
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting (396ae3eb-4174-4b9b-880e-dc0364d78a19)	Sigma-Rules	Office Application Startup - T1137 (2c4d4e92-0ccf-4a97-b54c-86d662988a53)	Attack Pattern	1