Detect Add-ins in Google Chronicle
Adversaries abuse Microsoft Office add-ins to achieve persistence. Add-ins (WLL/XLL for Word/Excel, COM add-ins, VSTO add-ins, Outlook add-ins) are loaded automatically when the corresponding Office application starts. Bisonal malware used .wll files dropped in Word startup; Naikon APT used intel.wll via RoyalRoad; Turla's LunarLoader and LunarMail use Outlook add-ins. XLL add-ins are particularly dangerous as they can execute arbitrary code when loaded and can be delivered via email attachments.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1137 Office Application Startup
- Sub-technique
- T1137.006 Add-ins
- Canonical reference
- https://attack.mitre.org/techniques/T1137/006/
YARA-L Detection Query
rule office_addin_persistence_t1137_006 {
meta:
author = "Argus Detection Engineering"
description = "Detects Office add-in persistence via file drops to startup dirs, registry registration, or DLL loads by Office processes from non-standard paths (T1137.006)"
mitre_attack_tactic = "Persistence"
mitre_attack_technique = "T1137.006"
severity = "HIGH"
confidence = "HIGH"
reference = "https://attack.mitre.org/techniques/T1137/006/"
created = "2026-04-19"
version = "1.0"
events:
(
// Branch 1: Add-in file written to Office startup/add-in paths
$e1.metadata.event_type = "FILE_CREATION"
and (
re.regex($e1.target.file.full_path, `(?i)\.(wll|xll|xlam|xla|vsto|ppam|ppa)$`)
or re.regex($e1.target.file.full_path, `(?i)(Microsoft\\Word\\STARTUP|Microsoft\\Excel\\XLSTART|Microsoft\\AddIns|Microsoft\\Office\\AddIns)`)
)
and not re.regex($e1.principal.process.file.full_path, `(?i)(winword|excel|powerpnt|outlook|OfficeClickToRun|msiexec|OfficeC2RClient)\.exe`)
)
or
(
// Branch 2: Registry-based add-in registration under Office add-in keys
$e1.metadata.event_type = "REGISTRY_MODIFICATION"
and re.regex($e1.target.registry.registry_key, `(?i)(Excel|Word|Outlook|PowerPoint)\\.*Addin`)
)
or
(
// Branch 3: Office process loading add-in DLL from anomalous path
$e1.metadata.event_type = "PROCESS_MODULE_LOAD"
and re.regex($e1.principal.process.file.full_path, `(?i)(winword|excel|powerpnt|outlook)\.exe`)
and (
re.regex($e1.target.file.full_path, `(?i)\.(wll|xll)`)
or re.regex($e1.target.file.full_path, `(?i)(\\Users\\|\\Temp\\|\\AppData\\|\\Downloads\\)`)
)
and not re.regex($e1.target.file.full_path, `(?i)(\\Microsoft Office\\|\\Program Files\\Microsoft Office\\)`)
)
condition:
$e1Chronicle YARA-L 2.0 rule detecting three Office add-in persistence patterns for T1137.006: add-in file writes to Office startup directories from suspicious processes, registry key creation/modification under Office Addins paths, and Office application processes loading DLL/add-in files from user-writable or temporary locations outside standard Office installation paths.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate ISV (Independent Software Vendor) add-in installers such as Dynamics 365, SAP Business One, or Adobe Acrobat that register VSTO or COM add-ins under Office registry paths during installation
- Excel Power Query or Power Pivot operations that dynamically load .xlam files from user AppData directories as part of normal data model refresh workflows in analytics environments
- Corporate IT reimaging or provisioning scripts that configure Office add-ins by writing to XLSTART directories on newly deployed workstations before baseline detection tuning excludes known-good deployment hosts
Other platforms for T1137.006
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Drop WLL File to Word Startup Directory
Expected signal: Sysmon EventCode 11: FileCreate with TargetFilename ending in .wll in the Word STARTUP path, Image=powershell.exe. If Word is subsequently launched, Sysmon EventCode 7 would show the WLL being loaded.
- Test 2Register COM Add-in in Office Registry
Expected signal: Sysmon EventCode 12/13: RegistryKeyCreate and RegistryValueSet for HKCU\Software\Microsoft\Office\16.0\Excel\Addins\df00tech.TestAddIn with LoadBehavior=3.
- Test 3Create XLAM Add-in File (Excel Add-in)
Expected signal: Sysmon EventCode 11: FileCreate with TargetFilename ending in .xlam in the Excel XLSTART path, Image=powershell.exe.
References (5)
- https://attack.mitre.org/techniques/T1137/006/
- https://web.archive.org/web/20190526112859/https://labs.mwrinfosecurity.com/blog/add-in-opportunities-for-office-persistence/
- https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/
- https://www.welivesecurity.com/en/eset-research/to-the-moon-and-back-again-turlas-lunar-landing-in-diplomatic-missions/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1137.006/T1137.006.md
Unlock Pro Content
Get the full detection package for T1137.006 including response playbook, investigation guide, and atomic red team tests.