Microsoft Office Protected View Disabled via Registry Modification
This rule detects modifications to Microsoft Office registry keys that disable the Protected View feature. Adversaries may disable Protected View to bypass security warnings and execute malicious code embedded in Office documents without user intervention. The rule specifically looks for changes to registry values that control Protected View for attachments, internet files, intranet files, and unsafe locations, setting them to a disabled state (DWORD 0x00000001) or enabling specific protected view settings (DWORD 0x00000000).
Sigma
