deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Classes Autorun Keys Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
Date: 2019-10-25
ATT&CK techniques: T1547.001
Log source: windows/registry_set

Description:
Detects modification of Windows Registry Classes keys used for persistence.
Adversaries modify these autostart extensibility points (ASEP) to execute malicious code when file types are opened or actions are performed.
Various legitimate software also uses these keys. Currently, this rule only filters out known legitimate software paths,
thus it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.


Detection logic:
{
  "selection_classes_base": {
    "TargetObject|contains": "\\Software\\Classes"
  },
  "selection_classes_target": {
    "TargetObject|contains": [
      "\\Folder\\ShellEx\\ExtShellFolderViews",
      "\\Folder\\ShellEx\\DragDropHandlers",
      "\\Folder\\Shellex\\ColumnHandlers",
      "\\Filter",
      "\\Exefile\\Shell\\Open\\Command\\(Default)",
      "\\Directory\\Shellex\\DragDropHandlers",
      "\\Directory\\Shellex\\CopyHookHandlers",
      "\\CLSID\\{AC[PII_REDACTED]-4E11-9862-C17BE5A1767E}\\Instance",
      "\\CLSID\\{ABE3B9A4-257D-4B97-BD1A-294AF496222E}\\Instance",
      "\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance",
      "\\CLSID\\{083863F1-70DE-11d0-BD40-00A0C911CE86}\\Instance",
      "\\Classes\\AllFileSystemObjects\\ShellEx\\DragDropHandlers",
      "\\.exe",
      "\\.cmd",
      "\\ShellEx\\PropertySheetHandlers",
      "\\ShellEx\\ContextMenuHandlers"
    ]
  },
  "filter_main_drivers": {
    "Image": "C:\\Windows\\System32\\drvinst.exe"
  },
  "filter_main_empty": {
    "Details": "(Empty)"
  },
  "filter_main_null": {
    "Details": null
  },
  "filter_main_svchost": {
    "Image": "C:\\Windows\\System32\\svchost.exe",
    "TargetObject|contains": "\\lnkfile\\shellex\\ContextMenuHandlers\\"
  },
  "filter_optional_msoffice": {
    "Details": "{807583E5-5146-11D5-A672-00B0D022E945}"
  },
  "condition": "all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
  - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
  - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
Sigma Detection Rule: CurrentVersion NT Autorun Keys Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
Date: 2019-10-25
ATT&CK techniques: T1547.001
Log source: windows/registry_set

Description:
Detects modification of autostart extensibility point (ASEP) in registry.

Detection logic:
{
  "selection_nt_current_version_base": {
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
  },
  "selection_nt_current_version": {
    "TargetObject|contains": [
      "\\Winlogon\\VmApplet",
      "\\Winlogon\\Userinit",
      "\\Winlogon\\Taskman",
      "\\Winlogon\\Shell",
      "\\Winlogon\\GpExtensions",
      "\\Winlogon\\AppSetup",
      "\\Winlogon\\AlternateShells\\AvailableShells",
      "\\Windows\\IconServiceLib",
      "\\Windows\\Appinit_Dlls",
      "\\Image File Execution Options",
      "\\Font Drivers",
      "\\Drivers32",
      "\\Windows\\Run",
      "\\Windows\\Load"
    ]
  },
  "filter_main_empty": {
    "Details": "(Empty)"
  },
  "filter_main_null": {
    "Details": null
  },
  "filter_main_poqexec": {
    "Image": "C:\\Windows\\System32\\poqexec.exe"
  },
  "filter_main_legitimate_subkey": {
    "TargetObject|contains": "\\Image File Execution Options\\",
    "TargetObject|endswith": [
      "\\DisableExceptionChainValidation",
      "\\MitigationOptions"
    ]
  },
  "filter_main_security_extension_dc": {
    "Image": "C:\\Windows\\system32\\svchost.exe",
    "TargetObject|contains": [
      "\\Winlogon\\GPExtensions\\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\\PreviousPolicyAreas",
      "\\Winlogon\\GPExtensions\\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\\MaxNoGPOListChangesInterval"
    ],
    "Details": [
      "DWORD (0x00000001)",
      "DWORD (0x00000009)",
      "DWORD (0x000003c0)"
    ]
  },
  "filter_main_runt

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
  - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
  - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
Sigma Detection Rule: RDP Sensitive Settings Changed
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali
Date: 2022-08-06
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects tampering of RDP Terminal Service/Server sensitive settings.
Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.

Below is a list of registry keys/values that are monitored by this rule:

- Shadow: Used to enable Remote Desktop shadowing, which allows an administrator to view or control a user's session.
- DisableRemoteDesktopAntiAlias: Disables anti-aliasing for remote desktop sessions.
- DisableSecuritySettings: Disables certain security settings for Remote Desktop connections.
- fAllowUnsolicited: Allows unsolicited remote assistance offers.
- fAllowUnsolicitedFullControl: Allows unsolicited remote assistance offers with full control.
- InitialProgram: Specifies a program to run automatically when a user logs on to a remote computer.
- ServiceDll: Used in RDP hijacking techniques to specify a custom DLL to be loaded by the Terminal Services service.
- SecurityLayer: Specifies the security layer used for RDP connections.


Detection logic:
{
  "selection_shadow": {
    "TargetObject|contains": [
      "\\Control\\Terminal Server\\",
      "\\Windows NT\\Terminal Services\\"
    ],
    "TargetObject|endswith": "\\Shadow",
    "Details": [
      "DWORD (0x00000001)",
      "DWORD (0x00000002)",
      "DWORD (0x00000003)",
      "DWORD (0x00000004)"
    ]
  },
  "selection_terminal_services_key": {
    "TargetObject|contains": [
      "\\Control\\Terminal Server\\",
      "\\Windows NT\\Terminal Services\\"
    ],
    "TargetObject|endswith": [
      "\\DisableRemoteDesktopAntiAlias",
      "\\DisableSecuritySettings",
      "\\fAllowUnsolicited",
      "\\fAllowUnsolicitedFullControl"
    ],
    "Details": "DWORD (0x00000001)"
  },
  "selection_tamper_only": {
    "TargetObject|contains": [
      "\\Control\\Terminal Server\\InitialProgram",
      "\\Control\\Terminal Server\\WinStations\\RDP-Tcp\\InitialProgram",
      "\\services\\TermService\\Parameters\\ServiceDll",
      "\\Terminal Server\\WinStations\\RDP-Tcp\\SecurityLayer",
      "\\Windows NT\\Terminal Services\\InitialProgram"
    ]
  },
  "filter_main_securitylayer_tls": {
    "TargetObject|endswith": "\\SecurityLayer",
    "Details": "DWORD (0x00000002)"
  },
  "condition": "(selection_shadow or selection_terminal_services_key or selection_tamper_only) and not 1 of filter_main_*"
}

References:
  - http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/
  - http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/
  - https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services
  - https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/
  - https://blog.sekoia.io/darkgate-internals/
Sigma Detection Rule: New Application in AppCompat
Repository: SigmaHQ/sigma
Severity: informational
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-05-02
ATT&CK techniques: T1204.002
Log source: windows/registry_set

Description:
A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\AppCompatFlags\\Compatibility Assistant\\Store\\"
  },
  "condition": "selection"
}

References:
  - https://github.com/OTRF/detection-hackathon-apt29/issues/1
  - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/1.A.1_DFD6A782-9BDB-4550-AB6B-525E825B095E.md
Sigma Detection Rule: Potential EventLog File Location Tampering
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: D3F7A5105
Date: 2023-01-02
ATT&CK techniques: T1685.001
Log source: windows/registry_set

Description:
Detects tampering with EventLog service "file" key. In order to change the default location of an Evtx file. This technique is used to tamper with log collection and alerting

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\SYSTEM\\CurrentControlSet\\Services\\EventLog\\",
    "TargetObject|endswith": "\\File"
  },
  "filter": {
    "Details|contains": "\\System32\\Winevt\\Logs\\"
  },
  "condition": "selection and not filter"
}

References:
  - https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key
Sigma Detection Rule: New TimeProviders Registered With Uncommon DLL Name
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-06-19
ATT&CK techniques: T1547.003
Log source: windows/registry_set

Description:
Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider.
Adversaries may abuse time providers to execute DLLs when the system boots.
The Windows Time service (W32Time) enables time synchronization across and within domains.


Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Services\\W32Time\\TimeProviders",
    "TargetObject|endswith": "\\DllName"
  },
  "filter_main_w32time": {
    "Details": [
      "%SystemRoot%\\System32\\vmictimeprovider.dll",
      "%systemroot%\\system32\\w32time.dll",
      "C:\\Windows\\SYSTEM32\\w32time.DLL"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.003/T1547.003.md
Sigma Detection Rule: COM Object Hijacking Via Modification Of Default System CLSID Default Value
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-07-16
ATT&CK techniques: T1546.015
Log source: windows/registry_set

Description:
Detects potential COM object hijacking via modification of default system CLSID.

Detection logic:
{
  "selection_target_root": {
    "TargetObject|contains": "\\CLSID\\",
    "TargetObject|endswith": [
      "\\InprocServer32\\(Default)",
      "\\LocalServer32\\(Default)"
    ]
  },
  "selection_target_builtin_clsid": {
    "TargetObject|contains": [
      "\\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\\",
      "\\{2155fee3-2419-4373-b[PII_REDACTED]eb41f}\\",
      "\\{4590f811-1d3a-11d0-891f-00aa004b2e24}\\",
      "\\{4de225bf-cf59-4cfc-85f7-68b90f185355}\\",
      "\\{ddc05a5a-351a-4e06-8eaf-54ec1bc2dcea}\\",
      "\\{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A}\\",
      "\\{F82B4EF1-93A9-4DDE-8015-F7950A1A6E31}\\",
      "\\{7849596a-48ea-486e-8937-a2a3009f31a9}\\",
      "\\{0b91a74b-ad7c-4a9d-b563-29eef9167172}\\",
      "\\{603D3801-BD81-11d0-A3A5-00C04FD706EC}\\",
      "\\{30D49246-D217-465F-B00B-AC9DDD652EB7}\\",
      "\\{A7A63E5C-3877-4840-8727-C1EA9D7A4D50}\\",
      "\\{2227A280-3AEA-1069-A2DE-08002B30309D}\\",
      "\\{2DEA658F-54C1-4227-AF9B-260AB5FC3543}\\",
      "\\{AA509086-5Ca9-4C25-8F95-589D3C07B48A}\\"
    ]
  },
  "selection_susp_location_1": {
    "Details|contains": [
      ":\\Perflogs\\",
      "\\AppData\\Local\\",
      "\\Desktop\\",
      "\\Downloads\\",
      "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\",
      "\\System32\\spool\\drivers\\color\\",
      "\\Temporary Internet",
      "\\Users\\Public\\",
      "\\Windows\\Temp\\",
      "%appdata%",
      "%temp%",
      "%tmp%"
    ]
  },
  "selection_susp_location_2": [
    {
      "De

References:
  - https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/ (idea)
  - https://unit42.paloaltonetworks.com/snipbot-romcom-malware-variant/
  - https://blog.talosintelligence.com/uat-5647-romcom/
  - https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/darkhotel-a-cluster-of-groups-united-by-common-techniques
  - https://threatbook.io/blog/Analysis-of-APT-C-60-Attack-on-South-Korea
Sigma Detection Rule: Disable Windows Event Logging Via Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-04
ATT&CK techniques: T1685.001
Log source: windows/registry_set

Description:
Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\",
    "TargetObject|endswith": "\\Enabled",
    "Details": "DWORD (0x00000000)"
  },
  "filter_main_wevutil": {
    "Image": "C:\\Windows\\system32\\wevtutil.exe"
  },
  "filter_main_iis": {
    "Image|startswith": "C:\\Windows\\winsxs\\",
    "Image|endswith": "\\TiWorker.exe"
  },
  "filter_main_svchost": {
    "Image": "C:\\Windows\\System32\\svchost.exe",
    "TargetObject|contains": [
      "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-FileInfoMinifilter",
      "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-ASN1\\",
      "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-Kernel-AppCompat\\",
      "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-Runtime\\Error\\",
      "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-CAPI2/Operational\\"
    ]
  },
  "filter_main_trusted_installer": {
    "Image": "C:\\Windows\\servicing\\TrustedInstaller.exe",
    "TargetObject|contains": "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-Compat-Appraiser"
  },
  "filter_optional_empty": {
    "Image": ""
  },
  "filter_optional_null": {
    "Image": null
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://twitter.com/WhichbufferArda/status/[PII_REDACTED]80293889
  - https://github.com/DebugPrivilege/CPP/blob/c39d365617dbfbcb01fffad200d52b6239b2918c/Windows%20Defender/RestoreDefenderConfig.cpp
Sigma Detection Rule: Bypass UAC Using DelegateExecute
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-01-05
ATT&CK techniques: T1548.002
Log source: windows/registry_set

Description:
Bypasses User Account Control using a fileless method

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\open\\command\\DelegateExecute",
    "Details": "(Empty)"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand
  - https://devblogs.microsoft.com/oldnewthing/20100312-01/?p=14623
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-7---bypass-uac-using-sdclt-delegateexecute
Sigma Detection Rule: Potential AMSI COM Server Hijacking
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-04
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects changes to the AMSI come server registry key in order disable AMSI scanning functionalities. When AMSI attempts to starts its COM component, it will query its registered CLSID and return a non-existent COM server. This causes a load failure and prevents any scanning methods from being accessed, ultimately rendering AMSI useless

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\CLSID\\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\\InProcServer32\\(Default)"
  },
  "filter": {
    "Details": "%windir%\\system32\\amsi.dll"
  },
  "condition": "selection and not filter"
}

References:
  - https://enigma0x3.net/2017/07/19/bypassing-amsi-via-com-server-hijacking/
  - https://github.com/r00t-3xp10it/hacking-material-books/blob/43cb1e1932c16ff1f58b755bc9ab6b096046853f/obfuscation/simple_obfuscation.md#amsi-comreg-bypass
Sigma Detection Rule: Outlook EnableUnsafeClientMailRules Setting Enabled - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-08
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Outlook\\Security\\EnableUnsafeClientMailRules",
    "Details": "DWORD (0x00000001)"
  },
  "condition": "selection"
}

References:
  - https://support.microsoft.com/en-us/topic/how-to-control-the-rule-actions-to-start-an-application-or-run-a-macro-in-outlook-2016-and-outlook-2013-e4964b72-173c-959d-5d7b-ead562979048
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=44
Sigma Detection Rule: Potential Attachment Manager Settings Associations Tamper
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-01
Log source: windows/registry_set

Description:
Detects tampering with attachment manager settings policies associations to lower the default file type risks (See reference for more information)

Detection logic:
{
  "selection_main": {
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Associations\\"
  },
  "selection_value_default_file_type_rsik": {
    "TargetObject|endswith": "\\DefaultFileTypeRisk",
    "Details": "DWORD (0x00006152)"
  },
  "selection_value_low_risk_filetypes": {
    "TargetObject|endswith": "\\LowRiskFileTypes",
    "Details|contains": [
      ".zip;",
      ".rar;",
      ".exe;",
      ".bat;",
      ".com;",
      ".cmd;",
      ".reg;",
      ".msi;",
      ".htm;",
      ".html;"
    ]
  },
  "condition": "selection_main and 1 of selection_value_*"
}

References:
  - https://support.microsoft.com/en-us/topic/information-about-the-attachment-manager-in-microsoft-windows-c48a4dcd-8de5-2af5-ee9b-cd795ae42738
  - https://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c[PII_REDACTED]d1264f692c7664c02c68465
Sigma Detection Rule: Potentially Suspicious Command Executed Via Run Dialog Box - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Ahmed Farouk, Nasreddine Bencherchali
Date: 2024-11-01
ATT&CK techniques: T1059.001
Log source: windows/registry_set

Description:
Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key.
This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.


Detection logic:
{
  "selection_key": {
    "TargetObject|contains": "\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU"
  },
  "selection_powershell_command": {
    "Details|contains": [
      "powershell",
      "pwsh"
    ]
  },
  "selection_powershell_susp_keywords": {
    "Details|contains": [
      " -e ",
      " -ec ",
      " -en ",
      " -enc ",
      " -enco",
      "ftp",
      "Hidden",
      "http",
      "iex",
      "Invoke-"
    ]
  },
  "selection_wmic_command": {
    "Details|contains": "wmic"
  },
  "selection_wmic_susp_keywords": {
    "Details|contains": [
      "shadowcopy",
      "process call create"
    ]
  },
  "condition": "selection_key and (all of selection_powershell_* or all of selection_wmic_*)"
}

References:
  - https://medium.com/@ahmed.moh.farou2/fake-captcha-campaign-on-arabic-pirated-movie-sites-delivers-lumma-stealer-4f203f7adabf
  - https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71
  - https://www.forensafe.com/blogs/runmrukey.html
  - https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/
Sigma Detection Rule: Disable Macro Runtime Scan Scope
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-25
Log source: windows/registry_set

Description:
Detects tampering with the MacroRuntimeScanScope registry key to disable runtime scanning of enabled macros

Detection logic:
{
  "selection": {
    "TargetObject|contains|all": [
      "\\SOFTWARE\\",
      "\\Microsoft\\Office\\",
      "\\Common\\Security"
    ],
    "TargetObject|endswith": "\\MacroRuntimeScanScope",
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2018/09/12/office-vba-amsi-parting-the-veil-on-malicious-macros/
  - https://admx.help/?Category=Office2016&Policy=office16.Office.Microsoft.Policies.Windows::L_MacroRuntimeScanScope
  - https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/28cc6a2802d8176195ac19b3c8e9a749009a82a3/src/AMSIbypasses.vba
Sigma Detection Rule: Macro Enabled In A Potentially Suspicious Document
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-21
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects registry changes to Office trust records where the path is located in a potentially suspicious location

Detection logic:
{
  "selection_value": {
    "TargetObject|contains": "\\Security\\Trusted Documents\\TrustRecords"
  },
  "selection_paths": {
    "TargetObject|contains": [
      "/AppData/Local/Microsoft/Windows/INetCache/",
      "/AppData/Local/Temp/",
      "/PerfLogs/",
      "C:/Users/Public/",
      "file:///D:/",
      "file:///E:/"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/inversecos/status/[PII_REDACTED]21819397
  - Internal Research