Trust Access Disable For VBApplications

Title: Trust Access Disable For VBApplications
Status: test
Description:Detects registry changes to Microsoft Office "AccessVBOM" to a value of "1" which disables trust access for VBA on the victim machine and lets attackers execute malicious macros without any Microsoft Office warnings.
References:
  -https://twitter.com/inversecos/status/1494174785621819397
  -https://www.mcafee.com/blogs/other-blogs/mcafee-labs/zloader-with-a-new-infection-technique/
  -https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/
Author: Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems)
Date: 2020-05-22
modified:2023-08-17
Tags:

• -'attack.persistence'
• -'attack.defense-impairment'
• -'attack.t1112'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|endswith: '\Security\AccessVBOM'
    Details: 'DWORD (0x00000001)'
  condition:selection
Falsepositives:
  -Unlikely
Level: high