Uncommon Microsoft Office Trusted Location Added (f742bde7-9528-42e5-bd82-84f51a8387d2)
Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Modify Registry - T1112 (57340c81-c025-4189-8fa0-fc7ede51bae4) | Attack Pattern | Uncommon Microsoft Office Trusted Location Added (f742bde7-9528-42e5-bd82-84f51a8387d2) | Sigma-Rules | 1 |