Potential Persistence Via Microsoft Office Startup Folder

Severity: high
Author: Max Altgelt (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Source: upstream

Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1137` Office Application Startup

Event coverage

Provider	Event ID	Title
Sysmon	11	FileCreate

Stages and Predicates

Stage 1: `all of selection_word_paths`

or:
TargetFilename|contains: '\Office'
TargetFilename|contains: '\Program Files'
TargetFilename|contains: '\STARTUP'
TargetFilename|contains: '\Microsoft\Word\STARTUP'

Stage 2: `all of selection_word_extension`

or:
TargetFilename|endswith: .doc
TargetFilename|endswith: .docm
TargetFilename|endswith: .docx
TargetFilename|endswith: .dot
TargetFilename|endswith: .dotm
TargetFilename|endswith: .rtf

Stage 3: `all of selection_excel_paths`

or:
TargetFilename|contains: '\Office'
TargetFilename|contains: '\Program Files'
TargetFilename|contains: '\XLSTART'
TargetFilename|contains: '\Microsoft\Excel\XLSTART'

Stage 4: `all of selection_excel_extension`

or:
TargetFilename|endswith: .xls
TargetFilename|endswith: .xlsm
TargetFilename|endswith: .xlsx
TargetFilename|endswith: .xlt
TargetFilename|endswith: .xltm

Stage 5: `not filter_main_office`

or:
Image|endswith: '\EXCEL.exe'
Image|endswith: '\WINWORD.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`Image`	ends_with	`\EXCEL.exe` corpus 2 (sigma 2) `\WINWORD.exe` corpus 5 (sigma 5)
`TargetFilename`	ends_with	`.doc` `.docm` corpus 5 (sigma 5) `.docx` corpus 2 (sigma 2) `.dot` `.dotm` corpus 5 (sigma 5) `.rtf` `.xls` corpus 2 (sigma 2) `.xlsm` corpus 5 (sigma 5) `.xlsx` corpus 2 (sigma 2) `.xlt` corpus 2 (sigma 2) `.xltm` corpus 5 (sigma 5)
`TargetFilename`	match	`\Microsoft\Excel\XLSTART` corpus 2 (sigma 2) `\Microsoft\Word\STARTUP` corpus 2 (sigma 2) `\Office` corpus 2 (sigma 2) `\Program Files` corpus 2 (sigma 2) `\STARTUP` corpus 2 (sigma 2) `\XLSTART` corpus 2 (sigma 2)

Potential Persistence Via Microsoft Office Startup Folder

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: all of selection_word_paths

Stage 2: all of selection_word_extension

Stage 3: all of selection_excel_paths