Detectionmediumtest
Microsoft Excel Add-In Loaded From Uncommon Location
Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Nasreddine Bencherchali (Nextron Systems)Created Fri May 12af4c4609-5755-42fe-8075-4effb49f5d44windows
Log Source
WindowsImage Load (DLL)
ProductWindows← raw: windows
CategoryImage Load (DLL)← raw: image_load
Detection Logic
Detection Logic1 selector
detection:
selection:
Image|endswith: '\excel.exe'
ImageLoaded|contains:
# Note: Add or remove locations from this list based on your internal policy
- '\Desktop\'
- '\Downloads\'
- '\Perflogs\'
- '\Temp\'
- '\Users\Public\'
- '\Windows\Tasks\'
ImageLoaded|endswith: '.xll'
condition: selectionFalse Positives
Some tuning might be required to allow or remove certain locations used by the rule if you consider them as safe locations
MITRE ATT&CK
Tactics
Sub-techniques
Rule Metadata
Rule ID
af4c4609-5755-42fe-8075-4effb49f5d44
Status
test
Level
medium
Type
Detection
Created
Fri May 12
Path
rules/windows/image_load/image_load_office_excel_xll_susp_load.yml
Raw Tags
attack.executionattack.t1204.002