Detectionhightest
Trust Access Disable For VBApplications
Detects registry changes to Microsoft Office "AccessVBOM" to a value of "1" which disables trust access for VBA on the victim machine and lets attackers execute malicious macros without any Microsoft Office warnings.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Trent Liffick, Nasreddine Bencherchali (Nextron Systems)Created Fri May 22Updated Thu Aug 171a5c46e9-f32f-42f7-b2bc-6e9084db7fbfwindows
Log Source
WindowsRegistry Set
ProductWindows← raw: windows
CategoryRegistry Set← raw: registry_set
Detection Logic
Detection Logic1 selector
detection:
selection:
TargetObject|endswith: '\Security\AccessVBOM'
Details: 'DWORD (0x00000001)'
condition: selectionFalse Positives
Unlikely
False positives are unlikely for most environments. High confidence detection.
MITRE ATT&CK
Techniques
Related Rules
Similar
Rule not found9b894e57-033f-46cf-b7fa-a52804181973
Rule Metadata
Rule ID
1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf
Status
test
Level
high
Type
Detection
Created
Fri May 22
Modified
Thu Aug 17
Path
rules/windows/registry/registry_set/registry_set_office_access_vbom_tamper.yml
Raw Tags
attack.persistenceattack.defense-evasionattack.t1112