MITRE ATT&CKsub-technique
T1137.004 Outlook Home Page
- Domain
- enterprise
- Tactics
- Persistence
- Platforms
- Windows, Office Suite
- Version
- 1.2
- Created
- 2019-11-07
Description
Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.
Once malicious home pages have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious Home Pages will execute when the right Outlook folder is loaded/reloaded.
Related
Subtechnique of · MITRE ATT&CK (1)
- T1137 Office Application Startup technique
Tactic · MITRE ATT&CK (1)
- TA0003 Persistence tactic
Referenced by MITRE ATT&CK · mitigates (2)
Referenced by Compliance · mitigates (11)
- CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution CIS Safeguard v8.1
- CIS-7.4 Perform Automated Application Patch Management CIS Safeguard v8.1
- CIS-7.7 Remediate Detected Vulnerabilities CIS Safeguard v8.1
- CIS-9.1 Ensure Use of Only Fully Supported Browsers and Email Clients CIS Safeguard v8.1
- NIST-AC-6 Least Privilege NIST 800-53 control
- NIST-CM-2 Baseline Configuration NIST 800-53 control
- NIST-CM-6 Configuration Settings NIST 800-53 control
- NIST-SC-18 Mobile Code NIST 800-53 control
- NIST-SC-44 Detonation Chambers NIST 800-53 control
- NIST-SI-2 Flaw Remediation NIST 800-53 control
- NIST-SI-8 Spam Protection NIST 800-53 control
References
- https://docs.microsoft.com/en-us/office365/securitycompliance/detect-and-remediate-outlook-rules-forms-attack Microsoft Detect Outlook Forms
- https://github.com/sensepost/notruler SensePost NotRuler
- https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/ SensePost Outlook Home Page