Detection of Microsoft Office Protected View Disablement

Attackers frequently modify Windows Registry keys related to Microsoft Office security configurations to impair defensive controls. Specifically, by disabling 'Protected View', threat actors ensure that malicious documents, once downloaded or opened, bypass the sandbox environment designed to restrict code execution from untrusted sources. This technique, observed in campaigns by actors such as Gorgon Group, enables the successful execution of macro-based malware or exploits contained within document files. This behavior is a form of defense impairment that allows an attacker to proceed with malicious activity after initial access, effectively neutralizing a critical layer of defense provided by Microsoft Office security policies.

Attack Chain

1. Attacker sends a malicious Office document via spearphishing or direct download.
2. Victim receives the document or saves it to a local drive.
3. Attacker executes a secondary dropper or script on the host machine.
4. Script modifies HKEY_CURRENT_USER registry keys associated with Office Protected View (e.g., DisableInternetFilesInPV).
5. The integrity of the sandbox environment is removed by setting the specific registry values to disable safety checks.
6. Victim opens the malicious document, which executes macros or embedded code without being restricted by Protected View.
7. Final payload (malware) achieves execution and initiates command and control (C2).

Impact

Disabling Protected View significantly lowers the barrier for malware execution on Windows endpoints. Successful exploitation allows for the full compromise of the user session, credential theft, and potential lateral movement within the network. This technique is commonly leveraged as a precursor to ransomware deployment or long-term persistent espionage activities.

Recommendation

Deploy the provided Sigma rule to monitor for registry modifications related to Office security features. Block administrative scripts that attempt to modify these specific keys under HKCU/Software/Microsoft/Office. Monitor for anomalous execution of office-related processes immediately following registry changes to these specific paths.