Detection rules › Sigma

Potential Persistence Via Microsoft Office Add-In

Severity
high
Author
NVISO
Source
upstream

Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel).

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1137.006 Office Application Startup: Add-ins

Event coverage

ProviderEvent IDTitle
Sysmon11FileCreate

Stages and Predicates

Stage 1: 1 of selection_wlldropped

TargetFilename|endswith: .wll
TargetFilename|contains: '\Microsoft\Word\Startup\'

Stage 2: 1 of selection_xlldropped

TargetFilename|endswith: .xll
TargetFilename|contains: '\Microsoft\Excel\Startup\'

Stage 3: 1 of selection_xladropped

TargetFilename|endswith: .xlam
TargetFilename|contains: 'Microsoft\Excel\XLSTART\'

Stage 4: 1 of selection_generic

or:
TargetFilename|endswith: .ppam
TargetFilename|endswith: .xla
TargetFilename|endswith: .xlam
TargetFilename|contains: '\Microsoft\Addins\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetFilenameends_with
  • .ppam
  • .wll corpus 2 (sigma 2)
  • .xla
  • .xlam
  • .xll corpus 2 (sigma 2)
TargetFilenamematch
  • Microsoft\Excel\XLSTART\
  • \Microsoft\Addins\
  • \Microsoft\Excel\Startup\
  • \Microsoft\Word\Startup\