Potential Persistence Via Outlook Today Page (487bb375-12ef-41f6-baae-c6a1572b4dd1)
Detects potential persistence activity via outlook today page. An attacker can set a custom page to execute arbitrary code and link to it via the registry values "URL" and "UserDefinedUrl".
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Modify Registry - T1112 (57340c81-c025-4189-8fa0-fc7ede51bae4) | Attack Pattern | Potential Persistence Via Outlook Today Page (487bb375-12ef-41f6-baae-c6a1572b4dd1) | Sigma-Rules | 1 |