Skip to content

Hide Navigation Hide TOC

Python Function Execution Security Warning Disabled In Excel - Registry (17e53739-a1fc-4a62-b1b9-87711c2d5e44)

Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed. Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.

Cluster A Galaxy A Cluster B Galaxy B Level
Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579) Attack Pattern Python Function Execution Security Warning Disabled In Excel - Registry (17e53739-a1fc-4a62-b1b9-87711c2d5e44) Sigma-Rules 1
Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579) Attack Pattern Impair Defenses - T1562 (3d333250-30e4-4a82-9edc-756c68afc529) Attack Pattern 2