Windows Registry: Enable Microsoft DDE in Word or Excel Security Settings

title: "Windows Registry: Enable Microsoft DDE in Word or Excel Security Settings"
id: 97734659-47ab-4713-b4e0-ba6ffcabe7a4
status: test
description: This rule flags Windows registry changes that enable Dynamic Data Exchange (DDE) functionality for Microsoft Word or Excel. Attackers may leverage DDE to trigger execution paths from documents, making these settings important indicators of increased client-side execution capability. The detection relies on registry_set telemetry matching specific security-related keys and their DWORD values under Word and Excel.
references:
  - https://msrc.microsoft.com/update-guide/vulnerability/ADV170021
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_office_enable_dde.yml
author: frack113, Huntrule Team
date: 2022-02-26
modified: 2023-08-17
tags:
  - attack.execution
  - attack.t1559.002
logsource:
  category: registry_set
  product: windows
detection:
  selection_word:
    TargetObject|endswith: \Word\Security\AllowDDE
    Details:
      - DWORD (0x00000001)
      - DWORD (0x00000002)
  selection_excel:
    TargetObject|endswith:
      - \Excel\Security\DisableDDEServerLaunch
      - \Excel\Security\DisableDDEServerLookup
    Details: DWORD (0x00000000)
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 63647769-326d-4dde-a419-b925cc0caf42
    type: derived