Potential Persistence Via Microsoft Office Add-In

Title: Potential Persistence Via Microsoft Office Add-In
Status: test
Description:Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel).
References:
  -Internal Research
  -https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence
  -https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md
Author: NVISO
Date: 2020-05-11
modified:2023-02-08
Tags:

• -'attack.persistence'
• -'attack.t1137.006'

Logsource:

• category: file_event
• product: windows

Detection:
  selection_wlldropped:
    TargetFilename|contains: '\Microsoft\Word\Startup\'
    TargetFilename|endswith: '.wll'
  selection_xlldropped:
    TargetFilename|contains: '\Microsoft\Excel\Startup\'
    TargetFilename|endswith: '.xll'
  selection_xladropped:
    TargetFilename|contains: 'Microsoft\Excel\XLSTART\'
    TargetFilename|endswith: '.xlam'
  selection_generic:
    TargetFilename|contains: '\Microsoft\Addins\'
    TargetFilename|endswith:
      -'.xlam'
      -'.xla'
      -'.ppam'

  condition:1 of selection_*
Falsepositives:
  -Legitimate add-ins
Level: high