Office Macros Warning Disabled
Detects registry changes to Microsoft Office "VBAWarning" to a value of "1" which enables the execution of all macros, whether signed or unsigned.
Sigma rule (View on GitHub)
1title: Office Macros Warning Disabled
2id: 91239011-fe3c-4b54-9f24-15c86bb65913
3related:
4 - id: a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd
5 type: obsolete
6status: test
7description: Detects registry changes to Microsoft Office "VBAWarning" to a value of "1" which enables the execution of all macros, whether signed or unsigned.
8references:
9 - https://twitter.com/inversecos/status/1494174785621819397
10 - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/zloader-with-a-new-infection-technique/
11 - https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/
12author: Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems)
13date: 2020-05-22
14modified: 2024-03-19
15tags:
16 - attack.defense-evasion
17 - attack.t1112
18logsource:
19 category: registry_set
20 product: windows
21detection:
22 selection:
23 TargetObject|endswith: '\Security\VBAWarnings'
24 Details: 'DWORD (0x00000001)'
25 condition: selection
26falsepositives:
27 - Unlikely
28level: high
References
-
This blog was written by Kiran Raj & Kishan N. Introduction In the last few years, Microsoft Office macro malware using social engineering as a means
Read More -
The ScarCruft group (also known as APT37 or Temp.Reaper) is a nation-state sponsored APT actor. Recently, we had an opportunity to perform a deeper investigation on a host compromised by this group.
Read More
Related rules
- Activate Suppression of Windows Security Center Notifications
- Add DisallowRun Execution to Registry
- Allow RDP Remote Assistance Feature
- Blackbyte Ransomware Registry
- CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry