Sigma rule: Uncommon Microsoft Office Trusted Location Added

Rule

Title

Uncommon Microsoft Office Trusted Location Added

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2023-06-21

Modified

2023-09-29

File

rules/windows/registry/registry_set/registry_set_office_trusted_location_uncommon.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions.

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|contains: 'Security\Trusted Locations\Location'
    TargetObject|endswith: '\Path'
filter_exclude_known_paths:
    Details|contains:
        - '%APPDATA%\Microsoft\Templates'
        - '%%APPDATA%%\Microsoft\Templates'
        - '%APPDATA%\Microsoft\Word\Startup'
        - '%%APPDATA%%\Microsoft\Word\Startup'
        - ':\Program Files (x86)\Microsoft Office\root\Templates\'
        - ':\Program Files\Microsoft Office (x86)\Templates'
        - ':\Program Files\Microsoft Office\root\Templates\'
        - ':\Program Files\Microsoft Office\Templates\'
filter_main_office_click_to_run:
    Image|contains: ':\Program Files\Common Files\Microsoft Shared\ClickToRun\'
    Image|endswith: '\OfficeClickToRun.exe'
filter_main_office_apps:
    Image|contains:
        - ':\Program Files\Microsoft Office\'
        - ':\Program Files (x86)\Microsoft Office\'
condition: selection and not 1 of filter_main_* and not 1 of filter_exclude_*

False positives (as the rule lists them)

• Other unknown legitimate or custom paths need to be filtered to avoid false positives

Tags

• attack.persistence
• attack.defense-impairment
• attack.t1112

MITRE ATT&CK ids this rule names

• T1112

Related rules

• a0bed973-45fa-4625-adb5-6ecdf9be70ac (derived)

References

• Internal Research
• https://admx.help/?Category=Office2016&Policy=excel16.Office.Microsoft.Policies.Windows::L_TrustedLoc01

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_office_trusted_location_uncommon.yml