Windows Process Watch: PythonFunctionWarnings Disabled via Excel Security Registry Setting

title: "Windows Process Watch: PythonFunctionWarnings Disabled via Excel Security Registry Setting"
id: 7196de6f-3d82-4476-8d23-5746e7367c97
related:
  - id: 17e53739-a1fc-4a62-b1b9-87711c2d5e44
    type: similar
  - id: 023c654f-8f16-44d9-bb2b-00ff36a62af9
    type: derived
status: test
description: This rule flags process command lines that include a registry path and value indicating Python function execution warnings are disabled for Microsoft Excel. Suppressing these warnings can reduce visibility into Python-in-Excel activity and hinder alerting on potential malicious use. It relies on process creation telemetry containing the specific command-line fragments referencing Excel’s Security and the PythonFunctionWarnings value set to 0.
references:
  - https://support.microsoft.com/en-us/office/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f35958278327
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_registry_office_disable_python_security_warnings.yml
author: "@Kostastsale, Huntrule Team"
date: 2023-08-22
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - \Microsoft\Office\
      - \Excel\Security
      - PythonFunctionWarnings
    CommandLine|contains: " 0"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1