Suspicious Windows Registry Trust Record Change (via registry_event)

title: Suspicious Windows Registry Trust Record Change (via registry_event)
id: cd62f350-7991-58f8-aaa2-9c69e3c978be
status: stable
description: This rule detects trust record modification within the registry, suggesting use of macros
references:
    - https://attack.mitre.org/techniques/T1566/001/
    - https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/
    - http://az4n6.blogspot.com/2016/02/more-on-trust-records-macros-and.html
    - https://twitter.com/inversecos/status/1494174785621819397
author: Huntrule Team
date: 2026-01-30
tags:
    - attack.initial-access
    - attack.t1566.001
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains: '\Security\Trusted Documents\TrustRecords'
    condition: selection
falsepositives:
    - Unknown
level: medium