Registry access to the Office DDE enablement keys

1title: Registry access to the Office DDE enablement keys2id: e19a188a-b21b-4985-8ef3-67aa9f3582093status: experimental4description: |5  Matches a handle request or a permission change against the per-user registry6  keys that decide whether Word and Excel will execute a DDE or DDEAUTO field —7  the `AllowDDE` value under8  HKCU\Software\Microsoft\Office\<version>\Word\Security and the Excel key9  beside it, which the technique's own description names as how DDE is turned10  back on after Microsoft disabled it. AN1393 lists "registry keys enabling DDE"11  alongside the process-creation leg, and the registry leg is the only one in12  this brief that is specific to this technique: an Office document host13  spawning cmd.exe or powershell.exe is a real DDE artefact, but nothing on14  Sysmon EventID 1 separates a DDEAUTO field from a VBA macro, an embedded OLE15  object or an XLL add-in, and that parent-child observable is already published16  in this corpus under T1203 and T1204 — a third copy under this ID would17  attribute one event to three techniques without adding evidence for any of18  them. What this rule buys instead is the preparation step, and it pays for it19  in coverage: a document that fronts DDE on a host where the setting is already20  permissive produces no registry event at all, and is not seen here. The Office21  Options branch — `DontUpdateLinks`, `DDEAllowed`, `DDECleaned` — is22  deliberately excluded because ordinary Office use rewrites that key23  constantly. Group-policy writes are filtered out by path, which also means an24  administrator-level attacker who sets the value through the Policies branch is25  filtered out with them. The rule is written in the raw Security-channel26  vocabulary (`EventID`, `ObjectName`, `ObjectType`); Security 4657 would name27  the value written and whether it was set to 1, but it is not among this28  brief's log sources and splits key and value across `ObjectName` and29  `ObjectValueName`, so that feed needs a field mapping before it could be used.30  4656 reports the access requested, not the write that followed, so a match is31  the question and not the answer. Prerequisite: registry object access is not32  audited by default and is not in the MS or CIS baselines — without Audit33  Object Access (Registry) enabled and a SACL placed on these specific keys34  auditing Set Value and Create Subkey, this rule returns zero rows on every35  host, which reads as quiet when it means blind. A SACL that audits reads36  instead will match Word's own startup on every launch.37  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0504, not hand-written and not tested by its author. Any lab result is on this rule's own page.38references:39  - https://attack.mitre.org/techniques/T1559/00240  - https://attack.mitre.org/detectionstrategies/DET050441author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)42date: 2026-08-1643tags:44  - attack.execution45  - attack.t1559.00246logsource:47  product: windows48  service: security49detection:50  selection_event:51    EventID:52      - 465653      - 467054    ObjectType: 'Key'55  selection_office:56    ObjectName|contains: '\Microsoft\Office\'57  selection_dde_key:58    ObjectName|contains:59      - '\Word\Security'60      - '\Excel\Security'61  filter_policy:62    ObjectName|contains: '\Policies\Microsoft\Office'63  condition: selection_event and selection_office and selection_dde_key and not filter_policy64falsepositives:65  - "A user changing Trust Center settings in Word or Excel — macro warnings, protected view, external content or link updating — which writes the same per-user Security key that DDE enablement lives under. On a normal desktop estate this is the most frequent match, and it cannot be separated from a malicious write at this event because 4656 does not carry the value."66  - "Endpoint hardening and compliance remediation that sets AllowDDE and the macro-warning values directly in the user hive rather than through group policy, so the Policies filter does not remove it. This runs from a small fixed set of management binaries and is allowlistable on ProcessName rather than by lowering the level."67  - "Office installation, repair and click-to-run channel updates, which recreate the per-user Security keys for each installed application and produce a burst of handle requests on them."68  - "Profile roaming, user-state migration and registry backup tooling, which opens the Office branch of the user hive with write access as part of a whole-hive operation and generates the event without any value ever changing."69level: medium