Office Macros Warning Disabled

Title: Office Macros Warning Disabled
Status: test
Description:Detects registry changes to Microsoft Office "VBAWarning" to a value of "1" which enables the execution of all macros, whether signed or unsigned.
References:
  -https://twitter.com/inversecos/status/1494174785621819397
  -https://www.mcafee.com/blogs/other-blogs/mcafee-labs/zloader-with-a-new-infection-technique/
  -https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/
Author: Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems)
Date: 2020-05-22
modified:2024-03-19
Tags:

• -'attack.persistence'
• -'attack.defense-impairment'
• -'attack.t1112'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|endswith: '\Security\VBAWarnings'
    Details: 'DWORD (0x00000001)'
  condition:selection
Falsepositives:
  -Unlikely
Level: high