Windows: Registry change disabling MacroRuntimeScanScope runtime macro scanning

title: "Windows: Registry change disabling MacroRuntimeScanScope runtime macro scanning"
id: 1fbfce80-189e-4ea7-b316-5b19bf3d199c
description: This rule identifies modifications to the MacroRuntimeScanScope registry key under Microsoft Office common security settings with a value of DWORD 0x00000000. Disabling runtime scanning of enabled macros can help attackers reduce security visibility and detection of malicious Office macro behavior. It relies on Windows registry set telemetry that captures the TargetObject path and the written Details value.
status: test
date: 2022-10-25
modified: 2023-08-17
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
references:
  - https://www.microsoft.com/en-us/security/blog/2018/09/12/office-vba-amsi-parting-the-veil-on-malicious-macros/
  - https://admx.help/?Category=Office2016&Policy=office16.Office.Microsoft.Policies.Windows::L_MacroRuntimeScanScope
  - https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/28cc6a2802d8176195ac19b3c8e9a749009a82a3/src/AMSIbypasses.vba
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disable_macroruntimescanscope.yml
tags:
  - attack.defense-impairment
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains|all:
      - \SOFTWARE\
      - \Microsoft\Office\
      - \Common\Security
    TargetObject|endswith: \MacroRuntimeScanScope
    Details: DWORD (0x00000000)
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: ab871450-37dc-4a3a-997f-6662aa8ae0f1
    type: derived