While SigmaHQ had rules for Outlook Today/Home pages abuse (persistence related). The recent Specula blog from @TrustedSec revealed some new information that helped us update those rules.
Thanks to @dbertho & @0xSV1 contribution, we've updated the rule to increase the coverage.
Today, TrustedSec is releasing #Specula (our previously internal framework) into the world, which will transform the Outlook email client into a beaconing C2 agent. @Oddvarmoe and @freefirex2 walk through how to use Specula in our latest blog! hubs.la/Q02JfFFN0
