| elastic |
Persistence via Microsoft Office AddIns |
production |
2026-10-09 |
| elastic |
Suspicious Execution via Microsoft Office Add-Ins |
production |
2026-10-06 |
| elastic |
Persistence via Microsoft Outlook VBA |
production |
2026-09-18 |
| elastic |
Outlook Home Page Registry Modification |
production |
2026-09-18 |
| elastic |
M365 Exchange Inbox Phishing Evasion Rule Created |
production |
2026-09-18 |
| elastic |
Office Test Registry Persistence |
production |
2026-09-18 |
| elastic |
M365 Exchange Inbox Rule with Obfuscated Name |
production |
2026-09-18 |
| splunk |
Windows Outlook LoadMacroProviderOnBoot Persistence |
production |
2026-05-13 |
| splunk |
Windows Outlook Macro Created by Suspicious Process |
production |
2026-05-13 |
| splunk |
Windows Outlook Macro Security Modified |
production |
2026-05-13 |
| sigma |
Outlook Security Settings Updated - Registry |
test |
2026-01-09 |
| sigma |
IE Change Domain Zone |
test |
2023-08-17 |
| sigma |
Outlook Task/Note Reminder Received |
test |
2023-08-17 |
| sigma |
Outlook Macro Execution Without Warning Setting Enabled |
test |
2023-08-17 |
| sigma |
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting |
test |
2023-08-17 |
| sigma |
Registry Modification to Hidden File Extension |
test |
2023-08-17 |
| sigma |
Potential Persistence Via Microsoft Office Startup Folder |
test |
2023-06-22 |
| sigma |
Suspicious Outlook Macro Created |
test |
2023-02-08 |
| sigma |
New Outlook Macro Created |
test |
2023-02-08 |