Windows Registry: Microsoft Office Trusted Location Keys Updated
Alerts on Office “Trusted Locations” registry changes, excluding typical Click-to-Run and Office install activity.
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-21
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags updates to Windows registry entries under Security\Trusted Locations\Location that end with the \Path value used by Microsoft Office trusted locations. Attackers can abuse trusted locations to bypass macro security controls by causing Office to treat attacker-controlled files as safe. It relies on telemetry from registry set events, including the TargetObject path and the process Image that made the change so Office installation activity can be excluded.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: Microsoft Office Trusted Location Keys Updated"
id: c718a10b-5938-4c30-9bbe-5ab89d467a77
related:
- id: f742bde7-9528-42e5-bd82-84f51a8387d2
type: similar
- id: a0bed973-45fa-4625-adb5-6ecdf9be70ac
type: derived
status: test
description: This rule flags updates to Windows registry entries under Security\Trusted Locations\Location that end with the \Path value used by Microsoft Office trusted locations. Attackers can abuse trusted locations to bypass macro security controls by causing Office to treat attacker-controlled files as safe. It relies on telemetry from registry set events, including the TargetObject path and the process Image that made the change so Office installation activity can be excluded.
references:
- https://admx.help/?Category=Office2016&Policy=excel16.Office.Microsoft.Policies.Windows::L_TrustedLoc01
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/registry/registry_set/registry_set_office_trusted_location.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-21
modified: 2023-08-17
tags:
- attack.persistence
- attack.defense-impairment
- attack.t1112
- detection.threat-hunting
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: Security\Trusted Locations\Location
TargetObject|endswith: \Path
filter_main_office_click_to_run:
Image|contains: :\Program Files\Common Files\Microsoft Shared\ClickToRun\
Image|endswith: \OfficeClickToRun.exe
filter_main_office_apps:
Image|contains:
- :\Program Files\Microsoft Office\
- :\Program Files (x86)\Microsoft Office\
condition: selection and not 1 of filter_main_*
falsepositives:
- During office installations or setup, trusted locations are added, which will trigger this rule.
level: medium
license: DRL-1.1