T1137.004: Outlook Home Page
Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.[1]
Once malicious home pages have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious Home Pages will execute when the right Outlook folder is loaded/reloaded.[1]
Analyst context for executives and security teams
Outlook Home Page is a persistence technique that abuses a legacy Microsoft Outlook folder customization feature. If a compromised mailbox is modified to load a malicious internal or external URL, code can run when Outlook starts or when the affected folder is opened. For leaders, the practical issue is that persistence may live in the user’s mail environment and appear only when Outlook is used, so endpoint-only thinking can miss part of the risk.
Executive priority
Prioritize this where Microsoft Outlook and Office are business-critical, especially for executives, administrators, or users with access to sensitive mail. Ask whether the organization can prove it can identify unauthorized Outlook folder home page configuration changes, investigate affected mailboxes, and remove persistence without disrupting mail operations. This technique also supports audit and incident-readiness questions: are mailbox-level changes logged, retained, reviewed, and correlated with endpoint behavior?
Technical view
This is a Windows and Office Suite persistence sub-technique under Office Application Startup. SOC and IR teams should validate coverage for suspicious Outlook Home Page configuration in user mailboxes and correlate it with Outlook startup, folder open/reload activity, and any resulting process, script, network, or file behavior. MITRE does not provide official detection text for this object, but the relationship to DET0177 indicates a detection strategy focused on persistence via Outlook Home Page exploitation. External references also point analysts toward Microsoft guidance for detecting/remediating Outlook rules and forms abuse and SensePost NotRuler for defensive detection context around Ruler usage.
Likely telemetry
- Mailbox or Exchange/Office administrative audit logs showing Outlook folder home page or related mailbox configuration changes
- Outlook client activity and startup/open-folder timing where available
- Endpoint process telemetry for Outlook-spawned or Outlook-associated child activity
- Network telemetry for Outlook loading internal or external URLs from folder home pages
- Security alerts or EDR events involving suspicious Office process behavior
Detection direction
- Validate whether mailbox auditing and Office/Exchange logging capture changes to Outlook Home Page settings; absence of this logging is a key blind spot.
- Tune detections for unexpected home page URLs, especially external destinations or URLs inconsistent with normal business use.
- Correlate mailbox configuration changes with suspicious Outlook process behavior rather than relying on either mailbox or endpoint telemetry alone.
- Review DET0177-aligned logic if available in the environment, but test it against local Outlook/Exchange configurations before treating it as coverage.
- Use relationship context carefully: Ruler is known to use this object and NotRuler is referenced for defensive detection context, but do not assume every instance involves Ruler or OilRig.
Mitigation priorities
- Reduce exposure to legacy Outlook Home Page behavior where business requirements allow.
- Use behavior prevention on endpoint controls to detect or block suspicious Outlook-driven process, file, API, or network behavior.
- Keep Windows, Outlook, Office, and related mail infrastructure updated in line with the Update Software mitigation relationship.
- Harden monitoring and response procedures for mailbox-level persistence, including rapid review and remediation of suspicious Outlook configuration changes.
- Prioritize validation for high-value users and shared mailboxes because persistence in mail clients can affect incident containment and business communications.
Analyst notes and limits
This object is a sub-technique of T1137 Office Application Startup and is limited to Windows and Office Suite platforms in the supplied ATT&CK fields. Relationship context includes detection strategy DET0177, mitigations M1040 and M1051, and use by Ruler and OilRig. Those relationships provide useful prioritization and hunting context, not proof of current activity in any environment.
MITRE provides no official detection text for this technique in the supplied fields. Specific log sources, event names, and remediation steps depend on the organization’s Microsoft Outlook, Exchange, Office 365, endpoint security, and audit configuration. Local evidence is required before assessing exposure or detection coverage.
Outlook Home Page
Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.[1]
Once malicious home pages have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious Home Pages will execute when the right Outlook folder is loaded/reloaded.[1]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1137 | Office Application Startup | This object subtechnique of Office Application Startup. |
Groups, software, and campaigns
G0049: OilRig
OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.[1][2][3][4][5][6][7]
S0358: Ruler
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.2 | Current bundle | 726c2cecc2f6… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
SensePost Outlook Home Page
Stalmans, E. (2017, October 11). Outlook Home Page – Another Ruler Vector. Retrieved February 4, 2019.
Open source URL -
[2]
Microsoft Detect Outlook Forms
Fox, C., Vangel, D. (2018, April 22). Detect and Remediate Outlook Rules and Custom Forms Injections Attacks in Office 365. Retrieved February 4, 2019.
Open source URL -
[3]
SensePost NotRuler
SensePost. (2017, September 21). NotRuler - The opposite of Ruler, provides blue teams with the ability to detect Ruler usage against Exchange. Retrieved February 4, 2019.
Open source URL -
[4]
mitre-attack T1137.004Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.