Python Function Execution Security Warning Disabled In Excel

 1title: Python Function Execution Security Warning Disabled In Excel
 2id: 023c654f-8f16-44d9-bb2b-00ff36a62af9
 3related:
 4    - id: 17e53739-a1fc-4a62-b1b9-87711c2d5e44
 5      type: similar
 6status: test
 7description: |
 8    Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed.
 9    Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.    
10references:
11    - https://support.microsoft.com/en-us/office/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f35958278327
12author: '@Kostastsale'
13date: 2023-08-22
14tags:
15    - attack.defense-evasion
16    - attack.t1562.001
17logsource:
18    category: process_creation
19    product: windows
20detection:
21    selection:
22        CommandLine|contains|all:
23            - '\Microsoft\Office\'
24            - '\Excel\Security'
25            - 'PythonFunctionWarnings'
26        CommandLine|contains: ' 0'
27    condition: selection
28falsepositives:
29    - Unknown
30level: high