huntrule

Windows Registry: Enable Microsoft DDE in Word or Excel Security Settings

Detects registry changes that enable or permit DDE server launch/lookup for Word or Excel.

FreeReviewedSigma · Medium · v1
Product
windows
Category
registry_set
Author
frack113 (SigmaHQ), DRL 1.1
Published
2022-02-26
Updated
2026-07-30
AnalysisDetection
title: "Windows Registry: Enable Microsoft DDE in Word or Excel Security Settings"
id: 97734659-47ab-4713-b4e0-ba6ffcabe7a4
status: test
description: This rule flags Windows registry changes that enable Dynamic Data Exchange (DDE) functionality for Microsoft Word or Excel. Attackers may leverage DDE to trigger execution paths from documents, making these settings important indicators of increased client-side execution capability. The detection relies on registry_set telemetry matching specific security-related keys and their DWORD values under Word and Excel.
references:
  - https://msrc.microsoft.com/update-guide/vulnerability/ADV170021
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_office_enable_dde.yml
author: frack113, Huntrule Team
date: 2022-02-26
modified: 2023-08-17
tags:
  - attack.execution
  - attack.t1559.002
logsource:
  category: registry_set
  product: windows
detection:
  selection_word:
    TargetObject|endswith: \Word\Security\AllowDDE
    Details:
      - DWORD (0x00000001)
      - DWORD (0x00000002)
  selection_excel:
    TargetObject|endswith:
      - \Excel\Security\DisableDDEServerLaunch
      - \Excel\Security\DisableDDEServerLookup
    Details: DWORD (0x00000000)
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 63647769-326d-4dde-a419-b925cc0caf42
    type: derived