Outlook folder home page or Outlook Today URL set in the registry

1title: Outlook folder home page or Outlook Today URL set in the registry2id: f12d9869-e8c9-4a79-a212-e4ca136610423status: experimental4description: |5  Detects a write to the Outlook registry values that hold a folder home page6  — the URL Outlook fetches and renders inside its own process whenever the7  folder is opened after startup, executing whatever script the page carries8  without any macro setting being involved. This is the registry-side artefact9  of the Outlook Home Page sub-technique T1137.004, observed here through the10  parent strategy's analytic AN1116 because AN0502, the analytic under .00411  itself, offers only process_creation, image_load and PowerShell log sources12  and no registry feed at all. It says nothing about the other Office startup13  mechanisms: T1137.001 covers the Word and Excel template values, T1137.002 the14  Office test key and T1137.006 the add-in startup folders, none of which touch15  these keys. MITRE's RegistryPath knob names Outlook Today; the WebView folder16  URLs and the EnableRoamingFolderHomepages value, which an operator has to set17  back on to defeat the update that disabled folder home pages, are added here18  rather than taken from MITRE. The version number between the product name and19  the Outlook subkey is why nothing left of `\Outlook\` is anchored.20  The registry is only one of two delivery paths, and the narrower one: Ruler,21  the tool the technique's own citation names, sets the folder home page as a22  MAPI property on the mailbox over RPC/HTTP, so the WebView values never appear23  in HKCU on the victim and this arm sees nothing. Against that path24  EnableRoamingFolderHomepages is the sole local artefact, and only on a host25  that took the 2017 update. Sysmon registry monitoring is an explicit allowlist26  of paths, so confirm the Office subtree is inside the running configuration27  before reading an empty result as an absence. The level answers to the first28  false positive rather than to the severity of a true positive — high is29  appropriate only once an estate has confirmed it carries no legacy folder30  home pages and has baselined Outlook's own WebView writes away.31  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0398, not hand-written and not tested by its author. Any lab result is on this rule's own page.32references:33  - https://attack.mitre.org/techniques/T113734  - https://attack.mitre.org/detectionstrategies/DET039835author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)36date: 2026-08-1637tags:38  - attack.persistence39  - attack.t113740  - attack.t1137.00441logsource:42  category: registry_set43  product: windows44detection:45  selection:46    TargetObject|contains:47      - '\Outlook\WebView\'48      - '\Outlook\Today\UserDefinedUrl'49      - '\Outlook\Security\EnableRoamingFolderHomepages'50  condition: selection51falsepositives:52  - "Outlook itself populating its own WebView subkeys during profile creation, mailbox re-cache and shared or delegate mailbox opens. This is a product-generated write with no deployment and no user action behind it, it lands on every new profile, and it is the highest-volume benign source this rule has."53  - "Legacy line-of-business deployments that genuinely use folder home pages. Older CRM and workflow add-ins pointed an Outlook folder at an internal page, and an estate still running one pushes the same values to every mailbox by Group Policy or logon script on every refresh."54  - "An administrator deliberately re-enabling folder home pages after the Outlook update switched them off. Microsoft documents EnableRoamingFolderHomepages for exactly that compatibility case, so the write arrives from a support process with no adversary behind it."55  - "A user customising the Outlook Today pane through its own Customize dialog, which writes UserDefinedUrl. It is uncommon but entirely supported, so a single hit is a question to ask rather than an incident on its own."56  - "Profile roaming, migration and backup-restore tooling replaying an HKCU hive that already contained one of these values, which reproduces the original write on a new host without any new action having taken place."57level: medium