{"id":"f742bde7-9528-42e5-bd82-84f51a8387d2","title":"Uncommon Microsoft Office Trusted Location Added","description":"Detects changes to registry keys related to \"Trusted Location\" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions.","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-06-21","modified":"2023-09-29","tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"technique_ids":["T1112"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Other unknown legitimate or custom paths need to be filtered to avoid false positives"],"references":["Internal Research","https://admx.help/?Category=Office2016&Policy=excel16.Office.Microsoft.Policies.Windows::L_TrustedLoc01"],"source_path":"rules/windows/registry/registry_set/registry_set_office_trusted_location_uncommon.yml","source_sha256":"b95a8c9d34c2f26eb15e90978e648ad36c9a6b3f76a6ac0b4b176d5d01ebc737","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_office_trusted_location_uncommon.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Uncommon Microsoft Office Trusted Location Added\nid: f742bde7-9528-42e5-bd82-84f51a8387d2\nrelated:\n    - id: a0bed973-45fa-4625-adb5-6ecdf9be70ac\n      type: derived\nstatus: test\ndescription: Detects changes to registry keys related to \"Trusted Location\" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions.\nreferences:\n    - Internal Research\n    - https://admx.help/?Category=Office2016&Policy=excel16.Office.Microsoft.Policies.Windows::L_TrustedLoc01\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-06-21\nmodified: 2023-09-29\ntags:\n    - attack.persistence\n    - attack.defense-impairment\n    - attack.t1112\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection:\n        TargetObject|contains: 'Security\\Trusted Locations\\Location'\n        TargetObject|endswith: '\\Path'\n    filter_exclude_known_paths:\n        Details|contains:\n            - '%APPDATA%\\Microsoft\\Templates'\n            - '%%APPDATA%%\\Microsoft\\Templates'\n            - '%APPDATA%\\Microsoft\\Word\\Startup'\n            - '%%APPDATA%%\\Microsoft\\Word\\Startup'\n            - ':\\Program Files (x86)\\Microsoft Office\\root\\Templates\\'\n            - ':\\Program Files\\Microsoft Office (x86)\\Templates'\n            - ':\\Program Files\\Microsoft Office\\root\\Templates\\'\n            - ':\\Program Files\\Microsoft Office\\Templates\\'\n    filter_main_office_click_to_run:\n        Image|contains: ':\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\'\n        Image|endswith: '\\OfficeClickToRun.exe'\n    filter_main_office_apps:\n        Image|contains:\n            - ':\\Program Files\\Microsoft Office\\'\n            - ':\\Program Files (x86)\\Microsoft Office\\'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_exclude_*\nfalsepositives:\n    - Other unknown legitimate or custom paths need to be filtered to avoid false positives\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","page":"techniques/enterprise/T1112/"}],"data_path":"data/detection-rules/f742bde7-9528-42e5-bd82-84f51a8387d2.json","kind":"sigma"}