Microsoft Office Trusted Location Updated

Status: test
Severity: medium
Log source: category registry_set, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects changes to the registry keys related to "Trusted Location" of Microsoft Office. Attackers might add additional trusted locations to avoid macro security restrictions.

Known false positives

During office installations or setup, trusted locations are added, which will trigger this rule.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1112` Modify Registry
Defense Impairment	`T1112` Modify Registry

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: Microsoft Office Trusted Location Updated
id: a0bed973-45fa-4625-adb5-6ecdf9be70ac
related:
    - id: f742bde7-9528-42e5-bd82-84f51a8387d2
      type: similar
status: test
description: Detects changes to the registry keys related to "Trusted Location" of Microsoft Office. Attackers might add additional trusted locations to avoid macro security restrictions.
references:
    - https://admx.help/?Category=Office2016&Policy=excel16.Office.Microsoft.Policies.Windows::L_TrustedLoc01
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-21
modified: 2023-08-17
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
    - detection.threat-hunting
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: 'Security\Trusted Locations\Location'
        TargetObject|endswith: '\Path'
    filter_main_office_click_to_run:
        Image|contains: ':\Program Files\Common Files\Microsoft Shared\ClickToRun\'
        Image|endswith: '\OfficeClickToRun.exe'
    filter_main_office_apps:
        Image|contains:
            - ':\Program Files\Microsoft Office\'
            - ':\Program Files (x86)\Microsoft Office\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - During office installations or setup, trusted locations are added, which will trigger this rule.
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    TargetObject|contains: 'Security\Trusted Locations\Location'
    TargetObject|endswith: '\Path'

Stage 2: `not filter_main_*`

filter_main_office_click_to_run:
    Image|contains: ':\Program Files\Common Files\Microsoft Shared\ClickToRun\'
    Image|endswith: '\OfficeClickToRun.exe'
filter_main_office_apps:
    Image|contains:
        - ':\Program Files\Microsoft Office\'
        - ':\Program Files (x86)\Microsoft Office\'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	ends_with	`\OfficeClickToRun.exe`	`excludes:Image` `field:"Image" value:"\OfficeClickToRun.exe"`
`Image`	match	`:\Program Files\Common Files\Microsoft Shared\ClickToRun\`	`excludes:Image` `field:"Image" value:":\Program Files\Common Files\Microsoft Shared\ClickToRun\"`
`Image`	match	`:\Program Files (x86)\Microsoft Office\`	`excludes:Image` `field:"Image" value:":\Program Files (x86)\Microsoft Office\"`
`Image`	match	`:\Program Files\Microsoft Office\`	`excludes:Image` `field:"Image" value:":\Program Files\Microsoft Office\"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetObject`	ends_with	`\Path` corpus 2 (sigma 2)	`field:"TargetObject" kind:ends_with value:"\Path"`
`TargetObject`	match	`Security\Trusted Locations\Location` corpus 2 (sigma 2)	`field:"TargetObject" kind:match value:"Security\Trusted Locations\Location"`