T1137.004, Outlook Home Page, is a persistence technique that abuses a legacy feature of Microsoft Outlook. It applies to Windows and Office Suite.
How attackers use it
The Home Page feature customizes how Outlook folders look. It lets an internal or external URL load and display whenever a folder is opened. MITRE says a malicious HTML page can be crafted that executes code when loaded.
Once a malicious home page has been added to the user's mailbox, it loads when Outlook starts, and it runs when the right folder is loaded or reloaded. Like other Outlook methods, it lives in the mailbox rather than on the workstation. The page lists OilRig and the tool Ruler.
How to detect it
MITRE's analytics describe a chain: Outlook launches, a specific folder is accessed, and then a suspicious child process starts or COM-based execution is invoked. Another variant has Outlook loading remote content in a folder view and running embedded JavaScript or ActiveX or COM logic.
Watch for outlook.exe as parent of shells and script engines (Sysmon event ID 1), and for Outlook making network connections to hosts that have nothing to do with your mail servers (Sysmon event ID 3).
How to reduce the risk
- Apply Microsoft's patches. MITRE says macro blocking does not cover these Outlook features because their Visual Basic engine is separate. It points to KB3191938, which blocks Outlook Visual Basic and displays a malicious code warning, and KB4011091, which disables custom forms by default.
- Block child processes. Use Attack Surface Reduction rules on Windows 10 to stop Office applications from creating child processes.
Quick check
What triggers a malicious home page?
Outlook starting and the affected folder being loaded or reloaded.
Sources
- MITRE ATT&CK, T1137.004 Outlook Home Page
