Microsoft Office AddIn Creation

[rule]
description = """
Detects attempts to create or modify a file in known Microsoft Office add-ins directories. Adversaries may leverage
Microsoft Office Addins for persistence.
"""
id = "4a99e412-ca98-468e-8730-d62009af23f7"
license = "Elastic License v2"
name = "Microsoft Office AddIn Creation"
os_list = ["windows"]
reference = ["https://docs.microsoft.com/en-us/previous-versions/technet-magazine/ee851671(v=msdn.10)"]
version = "1.0.18"

query = '''
file where event.action != "deletion" and

  file.Ext.header_bytes : "4d5a*" and

  file.path :
    ("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Word\\Startup\\*",
     "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\AddIns\\*",
     "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*") and

  not (process.executable : "?:\\Windows\\sys*\\msiexec.exe" and file.path : "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\AddIns\\*") and 
  not process.executable : "?:\\Windows\\explorer.exe" and 
  not (process.code_signature.subject_name : "Lars Schenk" and process.code_signature.trusted == true)
'''

min_endpoint_version = "8.1.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1137"
name = "Office Application Startup"
reference = "https://attack.mitre.org/techniques/T1137/"


[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.1.0"