Potential Persistence Via Excel Add-in - Registry

Title: Potential Persistence Via Excel Add-in - Registry
Status: test
Description:Detect potential persistence via the creation of an excel add-in (XLL) file to make it run automatically when Excel is started.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md
  -https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence
Author: frack113
Date: 2023-01-15
modified:2023-08-17
Tags:

• -'attack.persistence'
• -'attack.t1137.006'

Logsource:

• product: windows
• category: registry_set

Detection:
  selection:
    TargetObject|contains: 'Software\Microsoft\Office\'
    TargetObject|endswith: '\Excel\Options'
    Details|startswith: '/R '
    Details|endswith: '.xll'
  condition:selection
Falsepositives:
  -Unknown
Level: high