Enable Microsoft Dynamic Data Exchange

Status: test
Severity: medium
Log source: category registry_set, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

Enable Dynamic Data Exchange protocol (DDE) in all supported editions of Microsoft Word or Excel.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1559.002` Inter-Process Communication: Dynamic Data Exchange

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: Enable Microsoft Dynamic Data Exchange
id: 63647769-326d-4dde-a419-b925cc0caf42
status: test
description: Enable Dynamic Data Exchange protocol (DDE) in all supported editions of Microsoft Word or Excel.
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/ADV170021
author: frack113
date: 2022-02-26
modified: 2023-08-17
tags:
    - attack.execution
    - attack.t1559.002
logsource:
    category: registry_set
    product: windows
detection:
    selection_word:
        TargetObject|endswith: '\Word\Security\AllowDDE'
        Details:
            - 'DWORD (0x00000001)'
            - 'DWORD (0x00000002)'
    selection_excel:
        TargetObject|endswith:
            - '\Excel\Security\DisableDDEServerLaunch'
            - '\Excel\Security\DisableDDEServerLookup'
        Details: 'DWORD (0x00000000)'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

1 of selection_*

Stage 1: `selection_word`

selection_word:
    TargetObject|endswith: '\Word\Security\AllowDDE'
    Details:
        - 'DWORD (0x00000001)'
        - 'DWORD (0x00000002)'

Stage 2: `selection_excel`

selection_excel:
    TargetObject|endswith:
        - '\Excel\Security\DisableDDEServerLaunch'
        - '\Excel\Security\DisableDDEServerLookup'
    Details: 'DWORD (0x00000000)'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Details`	eq	`DWORD (0x00000000)` corpus 38 (sigma 36, chronicle 2) `DWORD (0x00000001)` corpus 40 (sigma 36, chronicle 4) `DWORD (0x00000002)` corpus 10 (sigma 9, chronicle 1)	`field:"Details" kind:eq`
`TargetObject`	ends_with	`\Excel\Security\DisableDDEServerLaunch` `\Excel\Security\DisableDDEServerLookup` `\Word\Security\AllowDDE`	`field:"TargetObject" kind:ends_with`

Enable Microsoft Dynamic Data Exchange

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_word

Stage 2: selection_excel

Indicators

Stage 0: `condition`

Stage 1: `selection_word`

Stage 2: `selection_excel`