Office Macros Warning Disabled

 1title: Office Macros Warning Disabled
 2id: 91239011-fe3c-4b54-9f24-15c86bb65913
 3related:
 4    - id: a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd
 5      type: obsoletes
 6status: test
 7description: Detects registry changes to Microsoft Office "VBAWarning" to a value of "1" which enables the execution of all macros, whether signed or unsigned.
 8references:
 9    - https://twitter.com/inversecos/status/1494174785621819397
10    - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/zloader-with-a-new-infection-technique/
11    - https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/
12author: Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems)
13date: 2020/05/22
14modified: 2024/03/19
15tags:
16    - attack.defense_evasion
17    - attack.t1112
18logsource:
19    category: registry_set
20    product: windows
21detection:
22    selection:
23        TargetObject|endswith: '\Security\VBAWarnings'
24        Details: 'DWORD (0x00000001)'
25    condition: selection
26falsepositives:
27    - Unlikely
28level: high

References

• Something went wrong, but don’t fret — let’s give it another shot.

  
  Read More

• Zloader With a New Infection Technique | McAfee Blog

  

  This blog was written by Kiran Raj & Kishan N. Introduction In the last few years, Microsoft Office macro malware using social engineering as a means

  
  Read More

• ScarCruft surveilling North Korean defectors and human rights activists

  

  The ScarCruft group (also known as APT37 or Temp.Reaper) is a nation-state sponsored APT actor. Recently, we had an opportunity to perform a deeper investigation on a host compromised by this group.

  
  Read More

Related rules

• CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry
• Run Once Task Configuration in Registry
• Imports Registry Key From a File
• Imports Registry Key From an ADS
• Enable WDigest using PowerShell