huntrule

Windows Registry: TrustRecords key modification indicating macro-based initial access

Flags Windows registry writes to Security\Trusted Documents\TrustRecords, a signal consistent with macro-enabled initial access.

FreeReviewedSigma · Medium · v1
Product
windows
Category
registry_event
Author
Antonlovesdnb, Trent Liffick (@tliffick) (SigmaHQ), DRL 1.1
Published
2020-02-19
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Initial Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule alerts when a Windows registry event targets the Security\Trusted Documents\TrustRecords path, which stores trust record information. Attackers may modify these trust records to influence trusted document handling and facilitate execution of macro-enabled content. The detection relies on registry event telemetry that includes the TargetObject field and matches for that specific registry subkey.

Reporting behind it

Related detections9 linkedT1566.001 — drag to rearrange
Suspicious mstsc Launch of RDP File From User Download or Temp Path (via process_creation)
Suspicious Regsvr32 Squiblydoo Remote Scriptlet Execution via Command Line (via process_creation)
Possible Mamba 2FA AiTM Phishing URL Pattern
Suspicious DLL Written to Explorer IconCache Path
Suspicious DNS Query to HTML Smuggling AiTM Phishing Domain
Malicious Microsoft Word Spawning Anomalous Child Process via CVE-2023-36884 (via process_creation)
Malicious Equation Editor Child Process Execution via process_creation
Microsoft 365 inbound suspicious email delivered to Inbox or Junk
Web Browser Opens .HTM/.HTML from Downloads Folder on Windows
Windows Registry: TrustRecords key modification indicating macro-based initial access
Pivot detection · T1566.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.