Windows Registry: Microsoft Office Trusted Locations Modified

Alerts on Office “Trusted Locations” registry changes, excluding typical Click-to-Run and Office install activity.

FreeUnreviewedSigmamediumv1

windows-registry-microsoft-office-trusted-locations-modified-a0bed973

title: "Windows Registry: Microsoft Office Trusted Locations Modified"
id: c718a10b-5938-4c30-9bbe-5ab89d467a77
related:
  - id: f742bde7-9528-42e5-bd82-84f51a8387d2
    type: similar
  - id: a0bed973-45fa-4625-adb5-6ecdf9be70ac
    type: derived
status: test
description: This rule flags registry value changes under the Microsoft Office “Trusted Locations” path, identified by a TargetObject containing Security\Trusted Locations\Location and ending with \Path. Attackers may abuse Office trusted locations to bypass macro security controls by causing Office to treat attacker-controlled content as safe. The detection relies on Windows registry set telemetry and process image paths to exclude common Microsoft Office Click-to-Run and installed Office binaries.
references:
  - https://admx.help/?Category=Office2016&Policy=excel16.Office.Microsoft.Policies.Windows::L_TrustedLoc01
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/registry/registry_set/registry_set_office_trusted_location.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-21
modified: 2023-08-17
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
  - detection.threat-hunting
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: Security\Trusted Locations\Location
    TargetObject|endswith: \Path
  filter_main_office_click_to_run:
    Image|contains: :\Program Files\Common Files\Microsoft Shared\ClickToRun\
    Image|endswith: \OfficeClickToRun.exe
  filter_main_office_apps:
    Image|contains:
      - :\Program Files\Microsoft Office\
      - :\Program Files (x86)\Microsoft Office\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - During office installations or setup, trusted locations are added, which will trigger this rule.
level: medium
license: DRL-1.1

What it detects

This rule flags registry value changes under the Microsoft Office “Trusted Locations” path, identified by a TargetObject containing Security\Trusted Locations\Location and ending with \Path. Attackers may abuse Office trusted locations to bypass macro security controls by causing Office to treat attacker-controlled content as safe. The detection relies on Windows registry set telemetry and process image paths to exclude common Microsoft Office Click-to-Run and installed Office binaries.

Known false positives

During office installations or setup, trusted locations are added, which will trigger this rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.