Uncommon Microsoft Office Trusted Location Added
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Registry value modified" AND ((OBJECTNAME contains "Security\Trusted Locations\Location" OR (OBJECTNAME endswith "Security\Trusted Locations" AND OBJECTVALUENAME startswith "Location")) AND OBJECTNAME endswith "\Path") AND ((PROCESSNAME notcontains ":\Program Files\Common Files\Microsoft Shared\ClickToRun" OR PROCESSNAME notendswith "\OfficeClickToRun.exe") AND PROCESSNAME notcontains ":\Program Files\Microsoft Office\,:\Program Files (x86)\Microsoft Office") AND INFORMATION notcontains "%APPDATA%\Microsoft\Templates,%%APPDATA%%\Microsoft\Templates,%APPDATA%\Microsoft\Word\Startup,%%APPDATA%%\Microsoft\Word\Startup,:\Program Files (x86)\Microsoft Office\root\Templates\,:\Program Files\Microsoft Office (x86)\Templates,:\Program Files\Microsoft Office\root\Templates\,:\Program Files\Microsoft Office\Templates" select Action1.HOSTNAME,Action1.MESSAGE,Action1.OBJECTNAME,Action1.PROCESSNAME,Action1.PREVVAL,Action1.CHANGES
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Nasreddine Bencherchali (Nextron Systems)
