Skip to content

Hide Navigation Hide TOC

Python Function Execution Security Warning Disabled In Excel (023c654f-8f16-44d9-bb2b-00ff36a62af9)

Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed. Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.

Cluster A Galaxy A Cluster B Galaxy B Level
Python Function Execution Security Warning Disabled In Excel (023c654f-8f16-44d9-bb2b-00ff36a62af9) Sigma-Rules Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579) Attack Pattern 1
Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579) Attack Pattern Impair Defenses - T1562 (3d333250-30e4-4a82-9edc-756c68afc529) Attack Pattern 2