Potential Persistence Via Outlook Today Pages (487bb375-12ef-41f6-baae-c6a1572b4dd1)
Detects potential persistence activity via outlook today pages. An attacker can set a custom page to execute arbitrary code and link to it via the registry key "UserDefinedUrl".
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Potential Persistence Via Outlook Today Pages (487bb375-12ef-41f6-baae-c6a1572b4dd1) | Sigma-Rules | Modify Registry - T1112 (57340c81-c025-4189-8fa0-fc7ede51bae4) | Attack Pattern | 1 |