Outlook Macro Execution Without Warning Setting Enabled

Title: Outlook Macro Execution Without Warning Setting Enabled
Status: test
Description:Detects the modification of Outlook security setting to allow unprompted execution of macros.
References:
  -https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/
  -https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53
Author: @ScoubiMtl
Date: 2021-04-05
modified:2023-08-17
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.command-and-control'
• -'attack.t1137'
• -'attack.t1008'
• -'attack.t1546'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|endswith: '\Outlook\Security\Level'
    Details|contains: '0x00000001'
  condition:selection
Falsepositives:
  -Unlikely
Level: high