NotDoor Outlook Persistence via LoadMacroProviderOnBoot Registry

Ankit Mehta@Secvyn

•updated Jun 29, 2026•3•0•2

Detects the modification of the 'LoadMacroProviderOnBoot' registry value in Microsoft Outlook. Enabling this setting can cause Outlook to load macros upon startup, which is a technique often leveraged for persistence or malicious code execution.