Windows Registry Trust Record Modification for Macro Usage
This rule detects modifications to the Windows Registry key associated with "TrustRecords" for Microsoft Office applications. These trust records are created when a user enables macros in a document, indicating that the document's source is trusted. Adversaries often leverage malicious macros in documents as an initial access vector. Monitoring changes to this registry path can help identify when macros are being enabled, potentially by a user interacting with a malicious document.
Sigma
