Microsoft Excel Add-In Loaded From Uncommon Location

Status: test
Severity: medium
Log source: category image_load, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location

Known false positives

Some tuning might be required to allow or remove certain locations used by the rule if you consider them as safe locations

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1204.002` User Execution: Malicious File

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 7: Image loaded

Rule body

title: Microsoft Excel Add-In Loaded From Uncommon Location
id: af4c4609-5755-42fe-8075-4effb49f5d44
related:
    - id: c5f4b5cb-4c25-4249-ba91-aa03626e3185
      type: derived
status: test
description: Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location
references:
    - https://www.mandiant.com/resources/blog/lnk-between-browsers
    - https://wazuh.com/blog/detecting-xll-files-used-for-dropping-fin7-jssloader-with-wazuh/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-12
tags:
    - attack.execution
    - attack.t1204.002
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\excel.exe'
        ImageLoaded|contains:
            # Note: Add or remove locations from this list based on your internal policy
            - '\Desktop\'
            - '\Downloads\'
            - '\Perflogs\'
            - '\Temp\'
            - '\Users\Public\'
            - '\Windows\Tasks\'
        ImageLoaded|endswith: '.xll'
    condition: selection
falsepositives:
    - Some tuning might be required to allow or remove certain locations used by the rule if you consider them as safe locations
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith: '\excel.exe'
    ImageLoaded|contains:
        - '\Desktop\'
        - '\Downloads\'
        - '\Perflogs\'
        - '\Temp\'
        - '\Users\Public\'
        - '\Windows\Tasks\'
    ImageLoaded|endswith: '.xll'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\excel.exe` corpus 16 (sigma 16)	`field:"Image" kind:ends_with value:"\excel.exe"`
`ImageLoaded`	ends_with	`.xll` corpus 2 (sigma 2)	`field:"ImageLoaded" kind:ends_with value:".xll"`
`ImageLoaded`	match	`\Desktop\` `\Downloads\` `\Perflogs\` corpus 2 (sigma 2) `\Temp\` corpus 2 (sigma 2) `\Users\Public\` `\Windows\Tasks\`	`field:"ImageLoaded" kind:match`

Microsoft Excel Add-In Loaded From Uncommon Location

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`