{"id":"0e20c89d-2264-44ae-8238-aeeaba609ece","title":"Potential Persistence Via Microsoft Office Startup Folder","description":"Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.","author":"Max Altgelt (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-06-02","modified":"2023-06-22","tags":["attack.persistence","attack.t1137"],"technique_ids":["T1137"],"logsource":{"category":"file_event","product":"windows"},"falsepositives":["Loading a user environment from a backup or a domain controller","Synchronization of templates"],"references":["https://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanese-companies","https://learn.microsoft.com/en-us/office/troubleshoot/excel/use-startup-folders"],"source_path":"rules/windows/file/file_event/file_event_win_office_startup_persistence.yml","source_sha256":"e1ed130667bdf7419ae674305cd9d3ee1d5566d9412c501e7c007e864b4f7372","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_office_startup_persistence.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Persistence Via Microsoft Office Startup Folder\nid: 0e20c89d-2264-44ae-8238-aeeaba609ece\nstatus: test\ndescription: Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.\nreferences:\n    - https://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanese-companies\n    - https://learn.microsoft.com/en-us/office/troubleshoot/excel/use-startup-folders\nauthor: Max Altgelt (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-06-02\nmodified: 2023-06-22\ntags:\n    - attack.persistence\n    - attack.t1137\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection_word_paths:\n        - TargetFilename|contains: '\\Microsoft\\Word\\STARTUP'\n        - TargetFilename|contains|all:\n              - '\\Office'\n              - '\\Program Files'\n              - '\\STARTUP'\n    selection_word_extension:\n        TargetFilename|endswith:\n            - '.doc'\n            - '.docm'\n            - '.docx'\n            - '.dot'\n            - '.dotm'\n            - '.rtf'\n    selection_excel_paths:\n        - TargetFilename|contains: '\\Microsoft\\Excel\\XLSTART'\n        - TargetFilename|contains|all:\n              - '\\Office'\n              - '\\Program Files'\n              - '\\XLSTART'\n    selection_excel_extension:\n        TargetFilename|endswith:\n            - '.xls'\n            - '.xlsm'\n            - '.xlsx'\n            - '.xlt'\n            - '.xltm'\n    filter_main_office:\n        Image|endswith:\n            - '\\WINWORD.exe'\n            - '\\EXCEL.exe'\n    condition: (all of selection_word_* or all of selection_excel_*) and not filter_main_office\nfalsepositives:\n    - Loading a user environment from a backup or a domain controller\n    - Synchronization of templates\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1137","id":"T1137","name":"Office Application Startup","page":"techniques/enterprise/T1137/"}],"data_path":"data/detection-rules/0e20c89d-2264-44ae-8238-aeeaba609ece.json","kind":"sigma"}