Elastic Defend high stable eql

Outlook Home Page Registry Modification

Identifies modifications in registry keys associated with abuse of the Outlook Home Page functionality for command and control or persistence.

View Source

Detection Logic

registry where event.action != "deletion" and
    registry.path : "HKEY_USERS\\S-1-5-*\\SOFTWARE\\Microsoft\\Office\\*\\Outlook\\Webview\\Inbox\\URL"

Field Validations

Loading…

Comments (0)

Loading comments...