Elastic medium stable eql

MS Office Macro Security Registry Modifications

Microsoft Office Products offer options for users and developers to control the security settings for running and using Macros. Adversaries may abuse these security settings to modify the default behavior of the Office Application to trust future macros and/or disable security warnings, which could increase their chances of establishing persistence.

View Source

Detection Logic

registry where host.os.type == "windows" and event.type == "change" and
    registry.value : ("AccessVBOM", "VbaWarnings") and
    registry.data.strings : ("0x00000001", "1")

/*
    Full registry key paths omitted due to data source variations:
    "HKCU\\S-1-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\AccessVBOM"
    "HKCU\\S-1-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\VbaWarnings"
*/

Field Validations

Loading…

Comments (0)

Loading comments...