Windows: Registry change disabling MacroRuntimeScanScope runtime macro scanning
Flags Office registry updates that set MacroRuntimeScanScope to 0x00000000, disabling runtime scanning for enabled macros.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-10-25
- Updated
- 2026-07-30
What it detects
This rule identifies modifications to the MacroRuntimeScanScope registry key under Microsoft Office common security settings with a value of DWORD 0x00000000. Disabling runtime scanning of enabled macros can help attackers reduce security visibility and detection of malicious Office macro behavior. It relies on Windows registry set telemetry that captures the TargetObject path and the written Details value.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2018/09/12/office-vba-amsi-parting-the-veil-on-malicious-macros/
- admx.helphttps://admx.help/?Category=Office2016&Policy=office16.Office.Microsoft.Policies.Windows::L_MacroRuntimeScanScope
- github.comhttps://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/28cc6a2802d8176195ac19b3c8e9a749009a82a3/src/AMSIbypasses.vba
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disable_macroruntimescanscope.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-change-disabling-macroruntimescanscope-runtime-macro-scanning-ab871450
title: "Windows: Registry change disabling MacroRuntimeScanScope runtime macro scanning"
id: 1fbfce80-189e-4ea7-b316-5b19bf3d199c
description: This rule identifies modifications to the MacroRuntimeScanScope registry key under Microsoft Office common security settings with a value of DWORD 0x00000000. Disabling runtime scanning of enabled macros can help attackers reduce security visibility and detection of malicious Office macro behavior. It relies on Windows registry set telemetry that captures the TargetObject path and the written Details value.
status: test
date: 2022-10-25
modified: 2023-08-17
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
references:
- https://www.microsoft.com/en-us/security/blog/2018/09/12/office-vba-amsi-parting-the-veil-on-malicious-macros/
- https://admx.help/?Category=Office2016&Policy=office16.Office.Microsoft.Policies.Windows::L_MacroRuntimeScanScope
- https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/28cc6a2802d8176195ac19b3c8e9a749009a82a3/src/AMSIbypasses.vba
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disable_macroruntimescanscope.yml
tags:
- attack.defense-impairment
logsource:
product: windows
category: registry_set
detection:
selection:
TargetObject|contains|all:
- \SOFTWARE\
- \Microsoft\Office\
- \Common\Security
TargetObject|endswith: \MacroRuntimeScanScope
Details: DWORD (0x00000000)
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: ab871450-37dc-4a3a-997f-6662aa8ae0f1
type: derived