Windows Registry: Uncommon Microsoft Office Trusted Location Path Added

Alerts on registry changes adding non-standard Microsoft Office Trusted Location paths that could undermine macro security.

FreeUnreviewedSigmahighv1

windows-registry-uncommon-microsoft-office-trusted-location-path-added-f742bde7

title: "Windows Registry: Uncommon Microsoft Office Trusted Location Path Added"
id: bbc866e0-e265-47a9-9082-d9cff0ed9814
related:
  - id: a0bed973-45fa-4625-adb5-6ecdf9be70ac
    type: derived
  - id: f742bde7-9528-42e5-bd82-84f51a8387d2
    type: derived
status: test
description: This rule flags registry writes targeting Microsoft Office “Trusted Locations” where the location path ends with “\Path” and the value is not in a known set of common Office or template directories. Attackers can add or modify trusted locations to bypass Office macro security checks and allow execution from otherwise blocked locations. The detection relies on Windows registry_set telemetry focusing on the TargetObject pattern and the provided allowlist and Click-to-Run/application path exclusions.
references:
  - Internal Research
  - https://admx.help/?Category=Office2016&Policy=excel16.Office.Microsoft.Policies.Windows::L_TrustedLoc01
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_office_trusted_location_uncommon.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-21
modified: 2023-09-29
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: Security\Trusted Locations\Location
    TargetObject|endswith: \Path
  filter_exclude_known_paths:
    Details|contains:
      - "%APPDATA%\\Microsoft\\Templates"
      - "%%APPDATA%%\\Microsoft\\Templates"
      - "%APPDATA%\\Microsoft\\Word\\Startup"
      - "%%APPDATA%%\\Microsoft\\Word\\Startup"
      - :\Program Files (x86)\Microsoft Office\root\Templates\
      - :\Program Files\Microsoft Office (x86)\Templates
      - :\Program Files\Microsoft Office\root\Templates\
      - :\Program Files\Microsoft Office\Templates\
  filter_main_office_click_to_run:
    Image|contains: :\Program Files\Common Files\Microsoft Shared\ClickToRun\
    Image|endswith: \OfficeClickToRun.exe
  filter_main_office_apps:
    Image|contains:
      - :\Program Files\Microsoft Office\
      - :\Program Files (x86)\Microsoft Office\
  condition: selection and not 1 of filter_main_* and not 1 of filter_exclude_*
falsepositives:
  - Other unknown legitimate or custom paths need to be filtered to avoid false positives
level: high
license: DRL-1.1

What it detects

This rule flags registry writes targeting Microsoft Office “Trusted Locations” where the location path ends with “\Path” and the value is not in a known set of common Office or template directories. Attackers can add or modify trusted locations to bypass Office macro security checks and allow execution from otherwise blocked locations. The detection relies on Windows registry_set telemetry focusing on the TargetObject pattern and the provided allowlist and Click-to-Run/application path exclusions.

Known false positives

Other unknown legitimate or custom paths need to be filtered to avoid false positives

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.