Execution via Microsoft Excel XLL Add-In

[rule]
description = """
Identifies attempt to execute and load an unsigned Microsoft Excel XLL Addin. This may indicate an attempt to get
initial access via a malicious phishing Microsoft Office Excel Add-In.
"""
id = "9efd977a-6d4a-4cc8-8ab3-355587b0ef69"
license = "Elastic License v2"
name = "Execution via Microsoft Excel XLL Add-In"
os_list = ["windows"]
reference = [
    "https://github.com/Octoberfest7/XLL_Phishing",
    "https://labs.f-secure.com/archive/add-in-opportunities-for-office-persistence/",
]
version = "1.0.25"

query = '''
sequence by process.entity_id with maxspan=2m
 [process where event.action == "start" and
  process.name : "EXCEL.EXE" and process.args : "-xlls"]
 [library where
  process.name : "EXCEL.EXE" and dll.name : "*.xll" and
  not dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*")]
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1137"
name = "Office Application Startup"
reference = "https://attack.mitre.org/techniques/T1137/"
[[threat.technique.subtechnique]]
id = "T1137.006"
name = "Add-ins"
reference = "https://attack.mitre.org/techniques/T1137/006/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.4.0"