Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•36

Detects the modification of the Outlook setting "LoadMacroProviderOnBoot" to enable the automatic loading of any configured VBA project/module, which can be abused for persistence.