Cross-source coverage

T1137.006 / ATT&CK

Office Application Startup: Add-ins

15 rules across 5 sources.

From MITRE ATT&CK 19.2

Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs. There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins.

Add-ins can be used to obtain persistence because they can be set to execute code when an Office application starts.

Tactics
Persistence
Platforms
Windows · Office Suite
Telemetry
WinEventLog:SysmonWinEventLog:ApplicationWinEventLog:Microsoft-Office/OutlookAddinMonitor

How MITRE says to detect it DET0050

Detect Persistence via Malicious Office Add-ins

Windows Analytic 0137

An adversary writes or drops a malicious Office Add-in (e.g., WLL, XLL, COM) to a trusted directory or modifies registry keys to load malicious add-ins on Office application launch. Upon user opening Word or Excel, the add-in is automatically loaded, triggering execution of the payload, often spawning scripting engines or anomalous child processes.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Sysmon EventCode=2
  • WinEventLog:Sysmon EventCode=13, 14

Office Suite Analytic 0138

Malicious Office add-ins loaded via VSTO, COM, or VBA auto-load paths. Upon launch of Word/Excel/Outlook, the add-in executes code without user action. Add-in resides in trusted directory or registered via Office COM/VBE subsystem. Behavior includes unsigned add-in execution, anomalous load context, or add-in spawning interpreter process.

  • WinEventLog:Application Office Add-in load errors, abnormal loading context, or unsigned add-in warnings
  • WinEventLog:Microsoft-Office/OutlookAddinMonitor Outlook loading add-in via unexpected load path or non-default profile context

socfortress/Wazuh-Rules

6 rules
Detection Severity Format
Sysmon - Event 1: Process creation · Excel Add-in XLL Execution (T1137.006) High Wazuh XML
Sysmon - Event 1: Process creation · Excel Auto-Loaded Add-in from AppData (T1137.006) High Wazuh XML
Sysmon - Event 1: Process creation · Excel VBA Add-in Auto-Start (XLAM) (T1137.006) High Wazuh XML
Sysmon - Event 1: Process creation · Office Add-in Launching Suspicious Child (T1137.006) High Wazuh XML
Sysmon - Event 1: Process creation · PowerPoint Add-in Auto-Start (PPAM) (T1137.006) High Wazuh XML
Sysmon - Event 1: Process creation · Word Auto-Loaded Add-in (WLL) (T1137.006) High Wazuh XML

SigmaHQ/sigma

4 rules
Detection Severity Format
Code Executed Via Office Add-in XLL File High Sigma
Potential Persistence Via Excel Add-in - Registry High Sigma
Potential Persistence Via Microsoft Office Add-In High Sigma
Potential Persistence Via Visual Studio Tools for Office Medium Sigma

elastic/detection-rules

2 rules
Detection Severity Format
Persistence via Microsoft Office AddIns High Elastic TOML
Suspicious Execution via Microsoft Office Add-Ins Medium Elastic TOML

elastic/protections-artifacts

2 rules
Detection Severity Format
Execution via Microsoft Excel XLL Add-In Undefined Elastic TOML
Process Creation via Microsoft Office Add-Ins Undefined Elastic TOML

Wazuh Core Ruleset

1 rule
Detection Severity Format
Office 365: Microsoft Power Automate (formerly called Microsoft Flow) events. Low Wazuh XML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.