Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting — Detection Rule

Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module

Read the full analysis on IntelFusions