Outlook VBA Macro/Rule Persistence via Registry and Child Process

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•3

This rule detects potential persistence mechanisms associated with Microsoft Outlook, specifically targeting registry modifications related to Outlook security settings or suspicious child processes (cmd.exe or powershell.exe) spawned by outlook.exe.