Windows Registry: Enable Microsoft DDE in Word or Excel Security Settings
Detects registry changes that enable or permit DDE server launch/lookup for Word or Excel.
- Product
- windows
- Category
- registry_set
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-02-26
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows registry changes that enable Dynamic Data Exchange (DDE) functionality for Microsoft Word or Excel. Attackers may leverage DDE to trigger execution paths from documents, making these settings important indicators of increased client-side execution capability. The detection relies on registry_set telemetry matching specific security-related keys and their DWORD values under Word and Excel.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: Enable Microsoft DDE in Word or Excel Security Settings"
id: 97734659-47ab-4713-b4e0-ba6ffcabe7a4
status: test
description: This rule flags Windows registry changes that enable Dynamic Data Exchange (DDE) functionality for Microsoft Word or Excel. Attackers may leverage DDE to trigger execution paths from documents, making these settings important indicators of increased client-side execution capability. The detection relies on registry_set telemetry matching specific security-related keys and their DWORD values under Word and Excel.
references:
- https://msrc.microsoft.com/update-guide/vulnerability/ADV170021
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_office_enable_dde.yml
author: frack113, Huntrule Team
date: 2022-02-26
modified: 2023-08-17
tags:
- attack.execution
- attack.t1559.002
logsource:
category: registry_set
product: windows
detection:
selection_word:
TargetObject|endswith: \Word\Security\AllowDDE
Details:
- DWORD (0x00000001)
- DWORD (0x00000002)
selection_excel:
TargetObject|endswith:
- \Excel\Security\DisableDDEServerLaunch
- \Excel\Security\DisableDDEServerLookup
Details: DWORD (0x00000000)
condition: 1 of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 63647769-326d-4dde-a419-b925cc0caf42
type: derived