Outlook

CVE-2024-21378 is a remote code execution vulnerability in Microsoft Outlook that enables attackers to execute arbitrary code by delivering a malicious email form containing a COM DLL.

Attackers may modify Outlook registry keys related to WebView and Today features to redirect web-based components to malicious URLs, facilitating phishing and credential theft.

Adversaries use PowerShell scripts leveraging Outlook COM objects to programmatically access and exfiltrate user email data from local systems.

Detects unauthorized modifications to Microsoft Outlook security-related registry keys that may be used to weaken email protections or establish persistence.

Adversaries can achieve persistence and code execution by modifying the Outlook WebView registry keys to point to a malicious URL.

Attackers abuse the Outlook Home Page functionality by modifying specific registry keys to point to attacker-controlled URLs or file paths, enabling command and control or persistence on compromised Windows systems.

Adversaries can modify Outlook Home Page registry settings to inject malicious content, enabling command and control or persistence, detected by monitoring specific registry keys for unusual URL or path values.

Attackers establish persistence by installing a malicious VBA template in Microsoft Outlook, triggering scripts upon application startup by modifying the VBAProject.OTM file, detected by monitoring for unauthorized file modifications.

Attackers modify Outlook security settings via registry changes to enable malicious mail rules and bypass security controls, potentially leading to persistence and data compromise.

The detection identifies the modification of the Windows Registry key 'PONT_STRING' under Outlook Options by a process other than Outlook.exe, potentially indicating malware activity such as NotDoor.

Attackers establish persistence by installing a malicious VBA template in Microsoft Outlook, triggering scripts upon application startup by modifying the VBAProject.OTM file.