{"id":"baecf8fb-edbf-429f-9ade-31fc3f22b970","title":"Office Autorun Keys Modification","description":"Detects modification of autostart extensibility point (ASEP) in registry. Adversaries may modify these keys to execute malicious code when Office files are opened.\nThere are various legitimate add-ins that also use these keys and this filter list might not be exhaustive.\nThus, it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.\n","author":"Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)","status":"test","level":"medium","date":"2019-10-25","modified":"2026-01-09","tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"technique_ids":["T1547.001"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Legitimate software or add-in installations and administrative configurations","Automatic registry modifications during legitimate software installations"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md","https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns","https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d"],"source_path":"rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_office.yml","source_sha256":"a6e71c36cc30ca92c9dd84d3c247f532c09fda8469a2c17d4e25ac98160e52c7","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_office.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Office Autorun Keys Modification\nid: baecf8fb-edbf-429f-9ade-31fc3f22b970\nrelated:\n    - id: 17f878b8-9968-4578-b814-c4217fc5768c\n      type: obsolete\nstatus: test\ndescription: |\n    Detects modification of autostart extensibility point (ASEP) in registry. Adversaries may modify these keys to execute malicious code when Office files are opened.\n    There are various legitimate add-ins that also use these keys and this filter list might not be exhaustive.\n    Thus, it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md\n    - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns\n    - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d # a list with registry keys\nauthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)\ndate: 2019-10-25\nmodified: 2026-01-09\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1547.001\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection_office_root:\n        TargetObject|contains:\n            - '\\Software\\Wow6432Node\\Microsoft\\Office'\n            - '\\Software\\Microsoft\\Office'\n    selection_office_details:\n        TargetObject|contains:\n            - '\\Word\\Addins'\n            - '\\PowerPoint\\Addins'\n            - '\\Outlook\\Addins'\n            - '\\Onenote\\Addins'\n            - '\\Excel\\Addins'\n            - '\\Access\\Addins'\n            - 'test\\Special\\Perf'\n    filter_main_empty:\n        Details: '(Empty)'\n    filter_main_null:\n        Details: null\n    filter_main_known_addins:\n        Image|startswith:\n            - 'C:\\Program Files\\Microsoft Office\\'\n            - 'C:\\Program Files (x86)\\Microsoft Office\\'\n            - 'C:\\PROGRA~2\\MICROS~2\\Office'\n            - 'C:\\Windows\\System32\\msiexec.exe'\n            - 'C:\\Windows\\SysWOW64\\msiexec.exe'\n            - 'C:\\Windows\\System32\\regsvr32.exe'\n            - 'C:\\Windows\\SysWOW64\\regsvr32.exe '\n        TargetObject|contains:\n            # Remove any unused addins in your environment from the filter\n            # Known addins for excel\n            - '\\Excel\\Addins\\AdHocReportingExcelClientLib.AdHocReportingExcelClientAddIn.1\\'\n            - '\\Excel\\Addins\\ExcelPlugInShell.PowerMapConnect\\'\n            - '\\Excel\\Addins\\NativeShim\\'\n            - '\\Excel\\Addins\\NativeShim.InquireConnector.1\\'\n            - '\\Excel\\Addins\\PowerPivotExcelClientAddIn.NativeEntry.1\\'\n            # Known addins for outlook\n            - '\\Outlook\\AddIns\\AccessAddin.DC\\'\n            - '\\Outlook\\AddIns\\ColleagueImport.ColleagueImportAddin\\'\n            - '\\Outlook\\AddIns\\EvernoteCC.EvernoteContactConnector\\'\n            - '\\Outlook\\AddIns\\EvernoteOLRD.Connect\\'\n            # - '\\Outlook\\Addins\\GrammarlyAddIn.Connect' # Uncomment if you use Grammarly\n            - '\\Outlook\\Addins\\\\OneNote.OutlookAddin'\n            - '\\Outlook\\Addins\\DriveFSExtensionLib.Connect\\' # An Outlook Add-in to talk with Google Drive\n            - '\\Outlook\\Addins\\GoogleAppsSync.Connect\\' # Google Apps Sync for Microsoft Outlook\n            - '\\Outlook\\Addins\\Microsoft.VbaAddinForOutlook.1\\'\n            - '\\Outlook\\Addins\\OcOffice.OcForms\\'\n            - '\\Outlook\\Addins\\OscAddin.Connect\\'\n            - '\\Outlook\\Addins\\OutlookChangeNotifier.Connect\\'\n            - '\\Outlook\\Addins\\UCAddin.LyncAddin.1'\n            - '\\Outlook\\Addins\\UCAddin.UCAddin.1'\n            - '\\Outlook\\Addins\\UmOutlookAddin.FormRegionAddin\\'\n            - 'AddinTakeNotesService\\FriendlyName'\n    filter_main_officeclicktorun:\n        Image|startswith:\n            - 'C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\'\n            - 'C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\Updates\\'\n        Image|endswith: '\\OfficeClickToRun.exe'\n    filter_main_vsto:\n        Image|startswith:\n            - 'C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\'\n            - 'C:\\Program Files (x86)\\Microsoft Shared\\VSTO\\'\n        Image|endswith: '\\VSTOInstaller.exe'\n    filter_optional_avg:\n        Image:\n            - 'C:\\Program Files\\AVG\\Antivirus\\RegSvr.exe'\n            - 'C:\\Program Files\\AVG\\Antivirus\\x86\\RegSvr.exe'\n        TargetObject|contains: '\\Microsoft\\Office\\Outlook\\Addins\\Antivirus.AsOutExt\\'\n    filter_optional_avast:\n        Image:\n            - 'C:\\Program Files\\Avast Software\\Avast\\RegSvr.exe'\n            - 'C:\\Program Files\\Avast Software\\Avast\\x86\\RegSvr.exe'\n        TargetObject|contains: '\\Microsoft\\Office\\Outlook\\Addins\\Avast.AsOutExt\\'\n    # These filters are not exhaustive, filter can be expanded based on environment\n    condition: all of selection_office_* and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Legitimate software or add-in installations and administrative configurations\n    - Automatic registry modifications during legitimate software installations\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1547.001","id":"T1547.001","name":"Registry Run Keys / Startup Folder","page":"techniques/enterprise/T1547.001/"}],"data_path":"data/detection-rules/baecf8fb-edbf-429f-9ade-31fc3f22b970.json","kind":"sigma"}