Windows Registry Trust Record Modification

Title: Windows Registry Trust Record Modification
Status: test
Description:Alerts on trust record modification within the registry, indicating usage of macros
References:
  -https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/
  -http://az4n6.blogspot.com/2016/02/more-on-trust-records-macros-and.html
  -https://twitter.com/inversecos/status/1494174785621819397
Author: Antonlovesdnb, Trent Liffick (@tliffick)
Date: 2020-02-19
modified:2023-06-21
Tags:

• -'attack.initial-access'
• -'attack.t1566.001'

Logsource:

• category: registry_event
• product: windows

Detection:
  selection:
    TargetObject|contains: '\Security\Trusted Documents\TrustRecords'
  condition:selection
Falsepositives:
  -This will alert on legitimate macro usage as well, additional tuning is required
Level: medium