Potential Persistence Via Microsoft Office Startup Folder — Sigma Rule

Rule metadata and linked tags

Author: Max Altgelt (Nextron Systems), Nasreddine Bencherchali (Nextron Systems). Source status: test; severity: high. Source dates: 2022-06-02 / 2023-06-22.

{
  "category": "file_event",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: e1ed130667bdf7419ae674305cd9d3ee1d5566d9412c501e7c007e864b4f7372

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Potential Persistence Via Microsoft Office Startup Folder
id: 0e20c89d-2264-44ae-8238-aeeaba609ece
status: test
description: Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.
references:
    - https://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanese-companies
    - https://learn.microsoft.com/en-us/office/troubleshoot/excel/use-startup-folders
author: Max Altgelt (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2022-06-02
modified: 2023-06-22
tags:
    - attack.persistence
    - attack.t1137
logsource:
    category: file_event
    product: windows
detection:
    selection_word_paths:
        - TargetFilename|contains: '\Microsoft\Word\STARTUP'
        - TargetFilename|contains|all:
              - '\Office'
              - '\Program Files'
              - '\STARTUP'
    selection_word_extension:
        TargetFilename|endswith:
            - '.doc'
            - '.docm'
            - '.docx'
            - '.dot'
            - '.dotm'
            - '.rtf'
    selection_excel_paths:
        - TargetFilename|contains: '\Microsoft\Excel\XLSTART'
        - TargetFilename|contains|all:
              - '\Office'
              - '\Program Files'
              - '\XLSTART'
    selection_excel_extension:
        TargetFilename|endswith:
            - '.xls'
            - '.xlsm'
            - '.xlsx'
            - '.xlt'
            - '.xltm'
    filter_main_office:
        Image|endswith:
            - '\WINWORD.exe'
            - '\EXCEL.exe'
    condition: (all of selection_word_* or all of selection_excel_*) and not filter_main_office
falsepositives:
    - Loading a user environment from a backup or a domain controller
    - Synchronization of templates
level: high

Original YAML and metadata in JSON

False positives

• Loading a user environment from a backup or a domain controller
• Synchronization of templates

Source references

• https://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanese-companies
• https://learn.microsoft.com/en-us/office/troubleshoot/excel/use-startup-folders