Windows Registry: TrustRecords key modification indicating macro-based initial access

Flags Windows registry writes to Security\Trusted Documents\TrustRecords, a signal consistent with macro-enabled initial access.

FreeUnreviewedSigmamediumv1

windows-registry-trustrecords-key-modification-indicating-macro-based-initial-ac-295a59c1

title: "Windows Registry: TrustRecords key modification indicating macro-based initial access"
id: 74cc3ac1-be1a-4135-bd15-902cea7ea1fa
related:
  - id: a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd
    type: similar
  - id: 295a59c1-7b79-4b47-a930-df12c15fc9c2
    type: derived
status: test
description: This rule alerts when a Windows registry event targets the Security\Trusted Documents\TrustRecords path, which stores trust record information. Attackers may modify these trust records to influence trusted document handling and facilitate execution of macro-enabled content. The detection relies on registry event telemetry that includes the TargetObject field and matches for that specific registry subkey.
references:
  - https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/
  - http://az4n6.blogspot.com/2016/02/more-on-trust-records-macros-and.html
  - https://twitter.com/inversecos/status/1494174785621819397
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_office_trust_record_modification.yml
author: Antonlovesdnb, Trent Liffick (@tliffick), Huntrule Team
date: 2020-02-19
modified: 2023-06-21
tags:
  - attack.initial-access
  - attack.t1566.001
logsource:
  category: registry_event
  product: windows
detection:
  selection:
    TargetObject|contains: \Security\Trusted Documents\TrustRecords
  condition: selection
falsepositives:
  - This will alert on legitimate macro usage as well, additional tuning is required
level: medium
license: DRL-1.1

What it detects

This rule alerts when a Windows registry event targets the Security\Trusted Documents\TrustRecords path, which stores trust record information. Attackers may modify these trust records to influence trusted document handling and facilitate execution of macro-enabled content. The detection relies on registry event telemetry that includes the TargetObject field and matches for that specific registry subkey.

Known false positives

This will alert on legitimate macro usage as well, additional tuning is required

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.