OilRigG0049 ↗
Has abused the Outlook Home Page feature for persistence. OilRig has also used CVE-2017-11774 to roll back the initial patch designed to protect against Home Page abuse.1
tfMITRE ATT&CK sub-technique
Outlook Home Page T1137.004
sub-technique of T1137 Office Application Startup
- Tactic
- Persistence
- Platforms
- Windows, Office Suite
- Version
- 1.2
- Created
- 07 November 2019
- Last modified
- 24 October 2025
Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Outlook Home Page MITRE reference T1137.004
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
Offense vs defense T1137.004
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Outlook Home Page detection strategy DET0177
MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Persistence via Outlook Home Page Exploitation
2 platforms
AN0502 · Windows
Adversary uses a tool like Ruler to configure a malicious Outlook folder Home Page that loads a remote or embedded HTML payload upon folder interaction. Execution chain begins with Outlook launching, a specific folder being accessed, and a suspicious child process being spawned or COM-based execution invoked.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Application Log ContentDC0038 | WinEventLog:Application | Outlook logs indicating failure to load or render HTML page in Home Page view |
| Command ExecutionDC0064 | WinEventLog:PowerShell | Execution of PowerShell script to enumerate or remove malicious Home Page folder config |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TargetFolder | Home Page can be configured on any folder like Calendar, Inbox, or custom folders |
| HTMLPayloadLocation | The Home Page URL may point to internal or external content, hosted on trusted or unknown domains |
| ChildProcessName | Execution may result in launch of scripting hosts (e.g., mshta.exe, wscript.exe) from outlook.exe |
| TimeWindow | Execution may occur only when the specific folder is accessed after launch, not immediately at startup |
| FormViewBehavior | Behavior may vary if the folder's form view is customized or suppressed via GPO |
AN0503 · Office Suite
Malicious HTML or script is rendered as a Home Page for a specific Outlook folder. Outlook accesses that folder, loads remote content, and executes embedded JavaScript or ActiveX/COM logic resulting in unauthorized actions or local execution.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | m365:unified | Folder configuration updated with external or HTML-formatted Home Page via Set-MailboxFolder |
| Command ExecutionDC0064 | m365:messagetrace | Inbound email triggering Outlook to auto-access folder tied to malicious Home Page |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AuditPolicyScope | Home Page customization may not be audited unless detailed message or folder auditing is enabled |
| FolderAccessRate | Anomalous access to folders not usually interacted with can signal triggering of malicious view |
| ExternalURLAllowlist | Mail clients may restrict remote Home Page content unless domain is explicitly allowed |
On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Office applications from creating child processes and from writing potentially malicious executable content to disk.
Update SoftwareM1051
For the Outlook methods, blocking macros may be ineffective as the Visual Basic engine used for these features is separate from the macro scripting engine. Microsoft has released patches to try to address each issue. Ensure KB3191938 which blocks Outlook Visual Basic and displays a malicious code warning, KB4011091 which disables custom forms by default, and KB4011162 which removes the legacy Home Page feature, are applied to systems.
Tests1Executorscmd 1Need elevation0 of 1Have prerequisites0Have cleanup1Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition