Python Function Execution Security Warning Disabled In Excel - Registry

 1title: Python Function Execution Security Warning Disabled In Excel - Registry
 2id: 17e53739-a1fc-4a62-b1b9-87711c2d5e44
 3related:
 4    - id: 023c654f-8f16-44d9-bb2b-00ff36a62af9
 5      type: similar
 6status: test
 7description: |
 8    Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed.
 9    Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.    
10references:
11    - https://support.microsoft.com/en-us/office/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f35958278327
12author: Nasreddine Bencherchali (Nextron Systems), @Kostastsale
13date: 2024-08-23
14tags:
15    - attack.defense-evasion
16    - attack.t1562.001
17logsource:
18    category: registry_set
19    product: windows
20detection:
21    selection:
22        TargetObject|contains: '\Microsoft\Office\'
23        TargetObject|endswith: '\Excel\Security\PythonFunctionWarnings'
24        Details: 'DWORD (0x00000001)'
25    condition: selection
26falsepositives:
27    - Unknown
28level: high