Detection rules › Sigma
Potential Persistence Via Microsoft Office Add-In
Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel).
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1137.006 Office Application Startup: Add-ins |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 11 | FileCreate |
Stages and Predicates
Stage 1: 1 of selection_wlldropped
TargetFilename|endswith: .wll
TargetFilename|contains: '\Microsoft\Word\Startup\'
Stage 2: 1 of selection_xlldropped
TargetFilename|endswith: .xll
TargetFilename|contains: '\Microsoft\Excel\Startup\'
Stage 3: 1 of selection_xladropped
TargetFilename|endswith: .xlam
TargetFilename|contains: 'Microsoft\Excel\XLSTART\'
Stage 4: 1 of selection_generic
or:
TargetFilename|endswith: .ppam
TargetFilename|endswith: .xla
TargetFilename|endswith: .xlam
TargetFilename|contains: '\Microsoft\Addins\'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
TargetFilename | ends_with |
|
TargetFilename | match |
|