Detectionhightest

Potential Persistence Via Excel Add-in - Registry

Detect potential persistence via the creation of an excel add-in (XLL) file to make it run automatically when Excel is started.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

François HubautCreated Sun Jan 15Updated Thu Aug 17961e33d1-4f86-4fcf-80ab-930a708b2f82windows

Log Source

WindowsRegistry Set

ProductWindows← raw: windows

CategoryRegistry Set← raw: registry_set

Detection Logic

detection:
    selection:
        TargetObject|contains: 'Software\Microsoft\Office\'
        TargetObject|endswith: '\Excel\Options'
        Details|startswith: '/R '
        Details|endswith: '.xll'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0003 · Persistence

Sub-techniques

T1137.006 · Add-ins

Rule Metadata

Rule ID

961e33d1-4f86-4fcf-80ab-930a708b2f82

Status

test

Level

high

Type

Detection

Created

Sun Jan 15

Modified

Thu Aug 17

Author

François Hubaut

Path

rules/windows/registry/registry_set/registry_set_persistence_xll.yml

Raw Tags

attack.persistenceattack.t1137.006

View on GitHub