Detection rules › Sigma

Uncommon Microsoft Office Trusted Location Added

Status
test
Severity
high
Log source
category registry_set, product windows
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions.

Known false positives

  • Other unknown legitimate or custom paths need to be filtered to avoid false positives

MITRE ATT&CK coverage

TacticTechniques
Persistence
Defense Impairment

Telemetry coverage

Rule body

title: Uncommon Microsoft Office Trusted Location Added
id: f742bde7-9528-42e5-bd82-84f51a8387d2
related:
    - id: a0bed973-45fa-4625-adb5-6ecdf9be70ac
      type: derived
status: test
description: Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions.
references:
    - Internal Research
    - https://admx.help/?Category=Office2016&Policy=excel16.Office.Microsoft.Policies.Windows::L_TrustedLoc01
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-21
modified: 2023-09-29
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: 'Security\Trusted Locations\Location'
        TargetObject|endswith: '\Path'
    filter_exclude_known_paths:
        Details|contains:
            - '%APPDATA%\Microsoft\Templates'
            - '%%APPDATA%%\Microsoft\Templates'
            - '%APPDATA%\Microsoft\Word\Startup'
            - '%%APPDATA%%\Microsoft\Word\Startup'
            - ':\Program Files (x86)\Microsoft Office\root\Templates\'
            - ':\Program Files\Microsoft Office (x86)\Templates'
            - ':\Program Files\Microsoft Office\root\Templates\'
            - ':\Program Files\Microsoft Office\Templates\'
    filter_main_office_click_to_run:
        Image|contains: ':\Program Files\Common Files\Microsoft Shared\ClickToRun\'
        Image|endswith: '\OfficeClickToRun.exe'
    filter_main_office_apps:
        Image|contains:
            - ':\Program Files\Microsoft Office\'
            - ':\Program Files (x86)\Microsoft Office\'
    condition: selection and not 1 of filter_main_* and not 1 of filter_exclude_*
falsepositives:
    - Other unknown legitimate or custom paths need to be filtered to avoid false positives
level: high

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_* and not 1 of filter_exclude_*

Stage 1: selection

selection:
    TargetObject|contains: 'Security\Trusted Locations\Location'
    TargetObject|endswith: '\Path'

Stage 2: not filter_main_*

filter_main_office_click_to_run:
    Image|contains: ':\Program Files\Common Files\Microsoft Shared\ClickToRun\'
    Image|endswith: '\OfficeClickToRun.exe'
filter_main_office_apps:
    Image|contains:
        - ':\Program Files\Microsoft Office\'
        - ':\Program Files (x86)\Microsoft Office\'

Stage 3: not filter_exclude_known_paths

filter_exclude_known_paths:
    Details|contains:
        - '%APPDATA%\Microsoft\Templates'
        - '%%APPDATA%%\Microsoft\Templates'
        - '%APPDATA%\Microsoft\Word\Startup'
        - '%%APPDATA%%\Microsoft\Word\Startup'
        - ':\Program Files (x86)\Microsoft Office\root\Templates\'
        - ':\Program Files\Microsoft Office (x86)\Templates'
        - ':\Program Files\Microsoft Office\root\Templates\'
        - ':\Program Files\Microsoft Office\Templates\'

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
Imageends_with\OfficeClickToRun.exeexcludes:Image field:"Image" value:"\OfficeClickToRun.exe"
Imagematch:\Program Files\Common Files\Microsoft Shared\ClickToRun\excludes:Image field:"Image" value:":\Program Files\Common Files\Microsoft Shared\ClickToRun\"
Imagematch:\Program Files (x86)\Microsoft Office\excludes:Image field:"Image" value:":\Program Files (x86)\Microsoft Office\"
Imagematch:\Program Files\Microsoft Office\excludes:Image field:"Image" value:":\Program Files\Microsoft Office\"
Detailsmatch%%APPDATA%%\Microsoft\Templatesexcludes:Details field:"Details" value:"%%APPDATA%%\Microsoft\Templates"
Detailsmatch%%APPDATA%%\Microsoft\Word\Startupexcludes:Details field:"Details" value:"%%APPDATA%%\Microsoft\Word\Startup"
Detailsmatch%APPDATA%\Microsoft\Templatesexcludes:Details field:"Details" value:"%APPDATA%\Microsoft\Templates"
Detailsmatch%APPDATA%\Microsoft\Word\Startupexcludes:Details field:"Details" value:"%APPDATA%\Microsoft\Word\Startup"
Detailsmatch:\Program Files (x86)\Microsoft Office\root\Templates\excludes:Details field:"Details" value:":\Program Files (x86)\Microsoft Office\root\Templates\"
Detailsmatch:\Program Files\Microsoft Office (x86)\Templatesexcludes:Details field:"Details" value:":\Program Files\Microsoft Office (x86)\Templates"
Detailsmatch:\Program Files\Microsoft Office\Templates\excludes:Details field:"Details" value:":\Program Files\Microsoft Office\Templates\"
Detailsmatch:\Program Files\Microsoft Office\root\Templates\excludes:Details field:"Details" value:":\Program Files\Microsoft Office\root\Templates\"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
TargetObjectends_with
  • \Path corpus 2 (sigma 2)
field:"TargetObject" kind:ends_with value:"\Path"
TargetObjectmatch
  • Security\Trusted Locations\Location corpus 2 (sigma 2)
field:"TargetObject" kind:match value:"Security\Trusted Locations\Location"