T1137.004 — Outlook Home Page

Tactic: Persistence · Platforms: Windows, Office Suite

Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder…

Sub-technique of Office Application Startup (T1137).

Sigma detection rules (2)

T1137.004 Office Application Startup: Outlook Home Page

title: "T1137.004 Office Application Startup: Outlook Home Page"
id: d4061849-f8fe-4751-a5b5-84ec21d76b1a
description: 'Detects creation or modification of the Outlook Home Page WebView registry value, the mechanism used to point an Outlook folder at a malicious HTML page for code execution when the folder is loaded. Tune using: TargetFolder, HTMLPayloadLocation, ChildProcessName, TimeWindow, FormViewBehavior.'
references:
  - https://attack.mitre.org/techniques/T1137/004
author: Shahrukh Khan
date: 2026-05-31
license: MIT
tags:
  - attack.persistence
  - attack.t1137.004

logsource:
  category: registry_set
  product: windows
  service: sysmon

detection:
  selection:
    TargetObject|contains: '\Outlook\WebView\'

  condition: selection

falsepositives:
  - Legitimate customization of an Outlook Home Page by IT for internal intranet dashboards; verify the configured URL against an allowlist of internal domains.

level: medium

T1137.004 Office Application Startup: Outlook Home Page

title: "T1137.004 Office Application Startup: Outlook Home Page"
id: df035111-d06b-4b44-9729-2f0dd50ebae3
description: 'T1137.004 (Outlook Home Page) is a Windows/Microsoft-Outlook-specific persistence mechanism (malicious HTML loaded as an Outlook folder home page) with NO direct Linux equivalent -- Linux mail clients (Thunderbird, Evolution) have no analogous "folder home page" feature, so this rule cannot detect the real technique. As the closest defensible Linux-observable proxy, it instead flags creation/modification of XDG autostart entries and shell login-profile files that could be used to launch an application with attacker-controlled content at login, a generic application-startup persistence signal rather than a genuine analogue of Outlook Home Page abuse. Tune using: AutostartPathAllowlist.'
references:
  - https://attack.mitre.org/techniques/T1137/004
author: Shahrukh Khan
date: 2026-03-29
license: MIT
tags:
  - attack.persistence
  - attack.t1137.004

logsource:
  category: file_event
  product: linux
  service: auditd

detection:
  selection:
    type: PATH
    nametype:
      - CREATE
      - NORMAL
    name|contains:
      - '/.config/autostart/'
      - '/.bash_profile'
      - '/.profile'
      - '/.bashrc'
  condition: selection

falsepositives:
  - This technique has no genuine Linux equivalent; the proxy signal (autostart/shell-profile file changes) will also fire on ordinary desktop-environment configuration and shell customization, and does not detect Outlook Home Page abuse itself, which is Windows/Outlook-only.

level: informational

Related sub-techniques

Explore