Potential Persistence Via Visual Studio Tools for Office

Severity: medium
Author: Bhabesh Raj
Source: upstream

Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1137.006` Office Application Startup: Add-ins

Event coverage

Provider	Event ID	Title
Sysmon	13	RegistryEvent (Value Set)

Stages and Predicates

Stage 1: `selection`

or:
TargetObject|contains: '\Software\Microsoft\Office\Excel\Addins\'
TargetObject|contains: '\Software\Microsoft\Office\Outlook\Addins\'
TargetObject|contains: '\Software\Microsoft\Office\Powerpoint\Addins\'
TargetObject|contains: '\Software\Microsoft\Office\Word\Addins\'
TargetObject|contains: '\Software\Microsoft\VSTO\Security\Inclusion\'

Stage 2: `not 1 of filter_main_*`

or:
or:
Image|endswith: '\Integrator.exe'
Image|endswith: '\Teams.exe'
Image|endswith: '\excel.exe'
Image|endswith: '\outlook.exe'
Image|endswith: '\powerpnt.exe'
Image|endswith: '\visio.exe'
Image|endswith: '\winword.exe'
or:
Image|startswith: 'C:\Program Files (x86)\Microsoft Office\OFFICE'
Image|startswith: 'C:\Program Files (x86)\Microsoft Office\Root\OFFICE'
Image|startswith: 'C:\Program Files\Microsoft Office\OFFICE'
Image|startswith: 'C:\Program Files\Microsoft Office\Root\OFFICE'
or:
Image|startswith: 'C:\Program Files\Common Files (x86)\Microsoft Shared\ClickToRun\'
Image|startswith: 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'
Image|endswith: '\OfficeClickToRun.exe'
Image: 'C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe'
Image: 'C:\Program Files\Microsoft Office\root\integration\integrator.exe'
Image: 'C:\Windows\SysWOW64\msiexec.exe'
Image: 'C:\Windows\SysWOW64\regsvr32.exe'
Image: 'C:\Windows\System32\msiexec.exe'
Image: 'C:\Windows\System32\regsvr32.exe'

Stage 3: `not 1 of filter_optional_*`

or:
Image: ['C:\Program Files (x86)\AVG\Antivirus\RegSvr.exe', 'C:\Program Files\AVG\Antivirus\RegSvr.exe']
TargetObject|contains: '\Microsoft\Office\Outlook\Addins\Antivirus.AsOutExt\'
Image: ['C:\Program Files (x86)\Avast Software\Avast\RegSvr.exe', 'C:\Program Files\Avast Software\Avast\RegSvr.exe']
TargetObject|contains: '\Microsoft\Office\Outlook\Addins\Avast.AsOutExt\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`Image`	ends_with	`\Integrator.exe` `\OfficeClickToRun.exe` corpus 10 (sigma 10) `\Teams.exe` corpus 4 (sigma 4) `\excel.exe` corpus 16 (sigma 16) `\outlook.exe` corpus 16 (sigma 16) `\powerpnt.exe` corpus 13 (sigma 13) `\visio.exe` corpus 3 (sigma 3) `\winword.exe` corpus 17 (sigma 17)
`Image`	eq	`C:\Program Files (x86)\AVG\Antivirus\RegSvr.exe` `C:\Program Files (x86)\Avast Software\Avast\RegSvr.exe` `C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe` corpus 6 (sigma 6) `C:\Program Files\AVG\Antivirus\RegSvr.exe` corpus 3 (sigma 3) `C:\Program Files\Avast Software\Avast\RegSvr.exe` corpus 3 (sigma 3) `C:\Program Files\Microsoft Office\root\integration\integrator.exe` corpus 6 (sigma 6) `C:\Windows\SysWOW64\msiexec.exe` corpus 4 (sigma 4) `C:\Windows\SysWOW64\regsvr32.exe` corpus 2 (sigma 2) `C:\Windows\System32\msiexec.exe` corpus 4 (sigma 4) `C:\Windows\System32\regsvr32.exe` corpus 2 (sigma 2)
`Image`	starts_with	`C:\Program Files (x86)\Microsoft Office\OFFICE` `C:\Program Files (x86)\Microsoft Office\Root\OFFICE` `C:\Program Files\Common Files (x86)\Microsoft Shared\ClickToRun\` `C:\Program Files\Common Files\Microsoft Shared\ClickToRun\` corpus 8 (sigma 8) `C:\Program Files\Microsoft Office\OFFICE` `C:\Program Files\Microsoft Office\Root\OFFICE`
`TargetObject`	match	`\Microsoft\Office\Outlook\Addins\Antivirus.AsOutExt\` corpus 2 (sigma 2) `\Microsoft\Office\Outlook\Addins\Avast.AsOutExt\` corpus 2 (sigma 2) `\Software\Microsoft\Office\Excel\Addins\` `\Software\Microsoft\Office\Outlook\Addins\` `\Software\Microsoft\Office\Powerpoint\Addins\` `\Software\Microsoft\Office\Word\Addins\` `\Software\Microsoft\VSTO\Security\Inclusion\`