Potential Persistence Via Visual Studio Tools for Office

Title: Potential Persistence Via Visual Studio Tools for Office
Status: test
Description:Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.
References:
  -https://twitter.com/_vivami/status/1347925307643355138
  -https://vanmieghem.io/stealth-outlook-persistence/
Author: Bhabesh Raj
Date: 2021-01-10
modified:2026-01-09
Tags:

• -'attack.t1137.006'
• -'attack.persistence'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|contains:
      -'\Software\Microsoft\Office\Outlook\Addins\'
      -'\Software\Microsoft\Office\Word\Addins\'
      -'\Software\Microsoft\Office\Excel\Addins\'
      -'\Software\Microsoft\Office\Powerpoint\Addins\'
      -'\Software\Microsoft\VSTO\Security\Inclusion\'

  filter_main_system:
    Image:
      -'C:\Windows\System32\msiexec.exe'
      -'C:\Windows\SysWOW64\msiexec.exe'
      -'C:\Windows\System32\regsvr32.exe'
      -'C:\Windows\SysWOW64\regsvr32.exe'

  filter_main_office_click_to_run:
    Image|startswith:
      -'C:\Program Files\Common Files (x86)\Microsoft Shared\ClickToRun\'
      -'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'

    Image|endswith: '\OfficeClickToRun.exe'
  filter_main_integrator:
    Image:
      -'C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe'
      -'C:\Program Files\Microsoft Office\root\integration\integrator.exe'

  filter_main_office_apps:
    Image|startswith:
      -'C:\Program Files\Microsoft Office\OFFICE'
      -'C:\Program Files (x86)\Microsoft Office\OFFICE'
      -'C:\Program Files\Microsoft Office\Root\OFFICE'
      -'C:\Program Files (x86)\Microsoft Office\Root\OFFICE'
      -'C:\PROGRA~2\MICROS~2\Office'

    Image|endswith:
      -'\excel.exe'
      -'\Integrator.exe'
      -'\OneNote.exe'
      -'\outlook.exe'
      -'\powerpnt.exe'
      -'\Teams.exe'
      -'\visio.exe'
      -'\winword.exe'

  filter_main_vsto:
    Image|startswith:
      -'C:\Program Files\Common Files\Microsoft Shared\VSTO\'
      -'C:\Program Files (x86)\Microsoft Shared\VSTO\'

    Image|endswith: '\VSTOInstaller.exe'
  filter_optional_avg:
    Image:
      -'C:\Program Files\AVG\Antivirus\RegSvr.exe'
      -'C:\Program Files (x86)\AVG\Antivirus\RegSvr.exe'

    TargetObject|contains: '\Microsoft\Office\Outlook\Addins\Antivirus.AsOutExt\'
  filter_optional_avast:
    Image:
      -'C:\Program Files\Avast Software\Avast\RegSvr.exe'
      -'C:\Program Files (x86)\Avast Software\Avast\RegSvr.exe'

    TargetObject|contains: '\Microsoft\Office\Outlook\Addins\Avast.AsOutExt\'
  condition:selection and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
  -Legitimate Addin Installation
Level: medium