Office Macros Warning Disabled via Registry

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•14

Detects a registry modification that disables security warnings for Microsoft Office macros, specifically setting the 'VBAWarnings' registry value to '1'. This configuration allows the execution of all macros, whether signed or unsigned, which can be abused by attackers for initial access, persistence, or defense evasion.