Cross-source coverage
T1137.006 / ATT&CK
Office Application Startup: Add-ins
15 rules across 5 sources.
From MITRE ATT&CK 19.2
Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs. There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins.
Add-ins can be used to obtain persistence because they can be set to execute code when an Office application starts.
- Tactics
- Persistence
- Platforms
- Windows · Office Suite
- Telemetry
-
WinEventLog:SysmonWinEventLog:ApplicationWinEventLog:Microsoft-Office/OutlookAddinMonitor
How MITRE says to detect it DET0050
Detect Persistence via Malicious Office Add-ins
Windows Analytic 0137
An adversary writes or drops a malicious Office Add-in (e.g., WLL, XLL, COM) to a trusted directory or modifies registry keys to load malicious add-ins on Office application launch. Upon user opening Word or Excel, the add-in is automatically loaded, triggering execution of the payload, often spawning scripting engines or anomalous child processes.
WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=11WinEventLog:SysmonEventCode=2WinEventLog:SysmonEventCode=13, 14
Office Suite Analytic 0138
Malicious Office add-ins loaded via VSTO, COM, or VBA auto-load paths. Upon launch of Word/Excel/Outlook, the add-in executes code without user action. Add-in resides in trusted directory or registered via Office COM/VBE subsystem. Behavior includes unsigned add-in execution, anomalous load context, or add-in spawning interpreter process.
WinEventLog:ApplicationOffice Add-in load errors, abnormal loading context, or unsigned add-in warningsWinEventLog:Microsoft-Office/OutlookAddinMonitorOutlook loading add-in via unexpected load path or non-default profile context
socfortress/Wazuh-Rules
6 rulesSigmaHQ/sigma
4 rules| Detection | Severity | Format |
|---|---|---|
| Code Executed Via Office Add-in XLL File | High | Sigma |
| Potential Persistence Via Excel Add-in - Registry | High | Sigma |
| Potential Persistence Via Microsoft Office Add-In | High | Sigma |
| Potential Persistence Via Visual Studio Tools for Office | Medium | Sigma |
elastic/detection-rules
2 rules| Detection | Severity | Format |
|---|---|---|
| Persistence via Microsoft Office AddIns | High | Elastic TOML |
| Suspicious Execution via Microsoft Office Add-Ins | Medium | Elastic TOML |
elastic/protections-artifacts
2 rules| Detection | Severity | Format |
|---|---|---|
| Execution via Microsoft Excel XLL Add-In | Undefined | Elastic TOML |
| Process Creation via Microsoft Office Add-Ins | Undefined | Elastic TOML |
Wazuh Core Ruleset
1 rule| Detection | Severity | Format |
|---|---|---|
| Office 365: Microsoft Power Automate (formerly called Microsoft Flow) events. | Low | Wazuh XML |