Enable Microsoft Dynamic Data Exchange

Title: Enable Microsoft Dynamic Data Exchange
Status: test
Description:Enable Dynamic Data Exchange protocol (DDE) in all supported editions of Microsoft Word or Excel.
References:
  -https://msrc.microsoft.com/update-guide/vulnerability/ADV170021
Author: frack113
Date: 2022-02-26
modified:2023-08-17
Tags:

• -'attack.execution'
• -'attack.t1559.002'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection_word:
    TargetObject|endswith: '\Word\Security\AllowDDE'
    Details:
      -'DWORD (0x00000001)'
      -'DWORD (0x00000002)'

  selection_excel:
    TargetObject|endswith:
      -'\Excel\Security\DisableDDEServerLaunch'
      -'\Excel\Security\DisableDDEServerLookup'

    Details: 'DWORD (0x00000000)'
  condition:1 of selection_*
Falsepositives:
  -Unknown
Level: medium