{"id":"961e33d1-4f86-4fcf-80ab-930a708b2f82","title":"Potential Persistence Via Excel Add-in - Registry","description":"Detect potential persistence via the creation of an excel add-in (XLL) file to make it run automatically when Excel is started.","author":"frack113","status":"test","level":"high","date":"2023-01-15","modified":"2023-08-17","tags":["attack.persistence","attack.t1137.006"],"technique_ids":["T1137.006"],"logsource":{"product":"windows","category":"registry_set"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md","https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence"],"source_path":"rules/windows/registry/registry_set/registry_set_persistence_xll.yml","source_sha256":"32ae724f1ef50ef0712aee42c7eab3ec1bb642acba9bfdf838dc5771bb992a20","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_persistence_xll.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Persistence Via Excel Add-in - Registry\nid: 961e33d1-4f86-4fcf-80ab-930a708b2f82\nstatus: test\ndescription: Detect potential persistence via the creation of an excel add-in (XLL) file to make it run automatically when Excel is started.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md\n    - https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence\nauthor: frack113\ndate: 2023-01-15\nmodified: 2023-08-17\ntags:\n    - attack.persistence\n    - attack.t1137.006\nlogsource:\n    product: windows\n    category: registry_set\ndetection:\n    selection:\n        TargetObject|contains: 'Software\\Microsoft\\Office\\'\n        TargetObject|endswith: '\\Excel\\Options'\n        Details|startswith: '/R '\n        Details|endswith: '.xll'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1137.006","id":"T1137.006","name":"Add-ins","page":"techniques/enterprise/T1137.006/"}],"data_path":"data/detection-rules/961e33d1-4f86-4fcf-80ab-930a708b2f82.json","kind":"sigma"}