Techniques › T1137 › T1137.004

T1137.004 Outlook Home Page

persistence — Windows, Office Suite · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

• DET0177 Detect Persistence via Outlook Home Page Exploitation v1.0
  AN0502 Windows

  Adversary uses a tool like Ruler to configure a malicious Outlook folder Home Page that loads a remote or embedded HTML payload upon folder interaction. Execution chain begins with Outlook launching, a specific folder being accessed, and a suspicious child process being spawned or COM-based execution invoked.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  WinEventLog:Application Outlook logs indicating failure to load or render HTML page in Home Page view → DC0038 Application Log Content

  WinEventLog:PowerShell Execution of PowerShell script to enumerate or remove malicious Home Page folder config → DC0064 Command Execution

  Tunable: TargetFolder HTMLPayloadLocation ChildProcessName TimeWindow FormViewBehavior
  AN0503 Office Suite

  Malicious HTML or script is rendered as a Home Page for a specific Outlook folder. Outlook accesses that folder, loads remote content, and executes embedded JavaScript or ActiveX/COM logic resulting in unauthorized actions or local execution.

  m365:unified Folder configuration updated with external or HTML-formatted Home Page via Set-MailboxFolder → DC0038 Application Log Content

  m365:messagetrace Inbound email triggering Outlook to auto-access folder tied to malicious Home Page → DC0064 Command Execution

  Tunable: AuditPolicyScope FolderAccessRate ExternalURLAllowlist

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1137.004

Rules tagged at the parent level (attack.t1137) 9

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.