Outlook Security Settings Updated - Registry

Title: Outlook Security Settings Updated - Registry
Status: test
Description:Detects changes to the registry values related to outlook security settings
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1137/T1137.md
  -https://learn.microsoft.com/en-us/outlook/troubleshoot/security/information-about-email-security-settings
Author: frack113
Date: 2021-12-28
modified:2026-01-09
Tags:

• -'attack.persistence'
• -'attack.t1137'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|contains|all:
      -'\SOFTWARE\Microsoft\Office\'
      -'\Outlook\Security\'

  filter_main_outlook:
    Image|startswith:
      -'C:\Program Files\Microsoft Office\'
      -'C:\Program Files (x86)\Microsoft Office\'

    Image|endswith: '\OUTLOOK.EXE'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Administrative activity
Level: medium