Enable Microsoft Dynamic Data Exchange
This rule detects modifications to registry keys that enable the Dynamic Data Exchange (DDE) protocol in Microsoft Word or Excel. Specifically, it looks for changes to 'AllowDDE' in Word or 'DisableDDEServerLaunch'/'DisableDDEServerLookup' in Excel to a value that enables DDE. Adversaries may enable DDE to execute arbitrary commands, often as part of phishing campaigns or through embedded files, to bypass macro-based defenses.
Sigma
