1200KM / simulation
T1137.006 Add-ins — Attack Simulation
Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs. There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and…
Technique description
Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs. There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and…
At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.
Official ATT&CK definition · Detection rules and anomaly models
Documented simulation candidates
- Persistent Code Execution Via Excel VBA Add-in File (XLAM)
Procedure 082141ed-b048-4c86-99c7-2b8da5b5bf48; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
- Code Executed Via Excel Add-in File (XLL)
Procedure 441b1a0f-a771-428a-8af0-e99e4698cda3; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
- Persistent Code Execution Via Word Add-in File (WLL)
Procedure 95408a99-4fa7-4cd6-a7ef-cb65f86351cf; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
- Persistent Code Execution Via Excel Add-in File (XLL)
Procedure 9c307886-9fef-41d5-b344-073a0f5b2f5f; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
- Persistent Code Execution Via PowerPoint VBA Add-in File (PPAM)
Procedure f89e58f9-2b49-423b-ac95-1f3e7cfd8277; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Connected ecosystem references
Linked tags
Detection and collection
Attack tools
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.