Outlook WebView Registry Modification for Persistence

This threat involves the abuse of the Outlook Home Page feature, which allows users to display a web page within an Outlook folder. By modifying specific registry keys associated with Outlook WebView settings, an attacker can force Outlook to load an arbitrary URL upon startup or when a specific folder is accessed. This technique serves as a persistence mechanism and a potential vector for code execution, as the displayed page executes within the context of the Outlook process. While this functionality was designed to support folder-specific home pages, its exploitation provides an effective method for maintaining presence on a compromised system without requiring highly privileged modifications. Defenders should monitor registry modifications targeting Outlook configuration paths.

Attack Chain

1. The attacker gains initial access to the target host through an unrelated vector.
2. The attacker identifies the Outlook configuration registry hive for the current user.
3. The attacker creates or modifies registry keys under HKCU\Software\Microsoft\Office\<version>\Outlook\WebView\.
4. The attacker sets the URL registry value to point to a malicious web resource or local file.
5. The Outlook application process (outlook.exe) is launched or restarted by the user or system.
6. The application reads the modified registry value to configure the WebView component.
7. The WebView component navigates to the attacker-supplied URL, executing the malicious content within the Outlook process context.

Impact

Successful exploitation allows for persistent code execution within the security context of the Outlook process, potentially facilitating further malicious activities, data exfiltration, or lateral movement.

Recommendation

1. Deploy the provided Sigma rule to monitor for registry modifications targeting Outlook WebView configuration paths.
2. Establish baselines for registry keys under HKCU\Software\Microsoft\Office\*\Outlook\WebView\ to distinguish between legitimate enterprise configuration and unauthorized modifications.
3. Restrict user ability to modify Outlook registry configuration via Group Policy where applicable.