Potential Persistence Via Microsoft Office Add-In

Status: test
Severity: high
Log source: category file_event, product windows
Author: NVISO
Source: github.com/SigmaHQ/sigma

Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel).

Known false positives

Legitimate add-ins

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1137.006` Office Application Startup: Add-ins

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule body

title: Potential Persistence Via Microsoft Office Add-In
id: 8e1cb247-6cf6-42fa-b440-3f27d57e9936
status: test
description: Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel).
references:
    - Internal Research
    - https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence
    - https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md
author: NVISO
date: 2020-05-11
modified: 2023-02-08
tags:
    - attack.persistence
    - attack.t1137.006
logsource:
    category: file_event
    product: windows
detection:
    selection_wlldropped:
        TargetFilename|contains: '\Microsoft\Word\Startup\'
        TargetFilename|endswith: '.wll'
    selection_xlldropped:
        TargetFilename|contains: '\Microsoft\Excel\Startup\'
        TargetFilename|endswith: '.xll'
    selection_xladropped:
        TargetFilename|contains: 'Microsoft\Excel\XLSTART\'
        TargetFilename|endswith: '.xlam'
    selection_generic:
        TargetFilename|contains: '\Microsoft\Addins\'
        TargetFilename|endswith:
            - '.xlam'
            - '.xla'
            - '.ppam'
    condition: 1 of selection_*
falsepositives:
    - Legitimate add-ins
level: high

Stages and Predicates

Stage 0: `condition`

1 of selection_*

Stage 1: `selection_wlldropped`

selection_wlldropped:
    TargetFilename|contains: '\Microsoft\Word\Startup\'
    TargetFilename|endswith: '.wll'

Stage 2: `selection_xlldropped`

selection_xlldropped:
    TargetFilename|contains: '\Microsoft\Excel\Startup\'
    TargetFilename|endswith: '.xll'

Stage 3: `selection_xladropped`

selection_xladropped:
    TargetFilename|contains: 'Microsoft\Excel\XLSTART\'
    TargetFilename|endswith: '.xlam'

Stage 4: `selection_generic`

selection_generic:
    TargetFilename|contains: '\Microsoft\Addins\'
    TargetFilename|endswith:
        - '.xlam'
        - '.xla'
        - '.ppam'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetFilename`	ends_with	`.ppam` `.wll` `.xla` `.xlam` `.xll` corpus 2 (sigma 1, splunk 1)	`field:"TargetFilename" kind:ends_with`
`TargetFilename`	match	`Microsoft\Excel\XLSTART\` `\Microsoft\Addins\` `\Microsoft\Excel\Startup\` `\Microsoft\Word\Startup\`	`field:"TargetFilename" kind:match`

Potential Persistence Via Microsoft Office Add-In

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_wlldropped

Stage 2: selection_xlldropped

Stage 3: selection_xladropped

Stage 4: selection_generic

Indicators

Stage 0: `condition`

Stage 1: `selection_wlldropped`

Stage 2: `selection_xlldropped`

Stage 3: `selection_xladropped`

Stage 4: `selection_generic`