Disable Macro Runtime Scan Scope
Detects attempts to disable the runtime scanning of enabled macros in Microsoft Office by modifying the 'MacroRuntimeScanScope' registry key. This modification can be used by adversaries to bypass security features like AMSI (Antimalware Scan Interface) for VBA macros, allowing malicious macros to execute undetected.
Sigma
