Microsoft Office AddIn Loaded

[rule]
description = """
Detects attempts to load an unsigned executable from known Microsoft Office add-ins directories. Adversaries may
leverage Office Addins for persistence.
"""
id = "aaa80718-1ed9-43bd-bcf7-97f2a6c93ea8"
license = "Elastic License v2"
name = "Microsoft Office AddIn Loaded"
os_list = ["windows"]
reference = ["https://docs.microsoft.com/en-us/previous-versions/technet-magazine/ee851671(v=msdn.10)"]
version = "1.0.27"

query = '''
library where
  process.name : ("winword.exe", "excel.exe") and
  (dll.code_signature.trusted == false or dll.code_signature.exists == false) and
  not dll.code_signature.status : ("errorExpired", "errorCode_endpoint*") and dll.hash.sha256 != null and
  dll.path :
    ("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Word\\Startup\\*",
     "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\AddIns\\*",
     "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*") and

  /* mainly https://github.com/Excel-DNA/ExcelDna */
  not dll.hash.sha256 :
               ("77fbc709353e2fc68091ef4eaf92d9926b1f36201e1cb5c59583867c6b8979e2",
                "20a33e2b3bf3da40a44b2001b60fbdac5e047154a169d77170b2ef7b0f5ae75a",
                "cb9b45da021609e16290e8abed62a6bc3c5ac588316bab40b091f64ea137e7df",
                "cb9b45da021609e16290e8abed62a6bc3c5ac588316bab40b091f64ea137e7df",
                "20a33e2b3bf3da40a44b2001b60fbdac5e047154a169d77170b2ef7b0f5ae75a",
                "b89a91c4cacda40c8ecafc9d9accd42d75a9158457273f12b1dbd0d1962becf3",
                "a5b7f6173251349613213e8ee0517e7677c03367b213d70d62f0f251283c3253",
                "582098e0e01d7beddd8f63333569aac96e06bfcef2d1ce61a9fddd99f651caf1",
                "b0a8ca7e555f53536e4f570ba3c8bf34274745bb63e70539fb080a1010dba053",
                "6e5fab5ccee725eb32144e36e1f0486f892ed99ad85e8d6a0354ced2eeed3759",
                "582098e0e01d7beddd8f63333569aac96e06bfcef2d1ce61a9fddd99f651caf1",
                "b0a8ca7e555f53536e4f570ba3c8bf34274745bb63e70539fb080a1010dba053",
                "6e5fab5ccee725eb32144e36e1f0486f892ed99ad85e8d6a0354ced2eeed3759",
                "e6ae5ef0a7b1d1a0276be13de9df13c2effbb8c70df45379a24882188d681b51",
                "83fd2689932d14a23f17de26ddc201f5a9f69060f550992feb421396c6914b06",
                "ff0c659513d58f670e1518fd529ba77dc2b051599dd74d88392a6c0a94414ee2")
'''

min_endpoint_version = "8.10.0"
optional_actions = []
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1137"
name = "Office Application Startup"
reference = "https://attack.mitre.org/techniques/T1137/"


[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.10.0"