Detect Add-ins in CrowdStrike LogScale
Adversaries abuse Microsoft Office add-ins to achieve persistence. Add-ins (WLL/XLL for Word/Excel, COM add-ins, VSTO add-ins, Outlook add-ins) are loaded automatically when the corresponding Office application starts. Bisonal malware used .wll files dropped in Word startup; Naikon APT used intel.wll via RoyalRoad; Turla's LunarLoader and LunarMail use Outlook add-ins. XLL add-ins are particularly dangerous as they can execute arbitrary code when loaded and can be delivered via email attachments.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1137 Office Application Startup
- Sub-technique
- T1137.006 Add-ins
- Canonical reference
- https://attack.mitre.org/techniques/T1137/006/
LogScale Detection Query
// T1137.006 — Office Add-in Persistence Detection
// Branch 1: Add-in file writes to Office startup/add-in directories
(
#event_simpleName = "AsepValueUpdate"
OR #event_simpleName = "WrittenDangerousFile"
OR #event_simpleName = "NewExecutableWritten"
)
| TargetFileName = /(?i)\.(wll|xll|xlam|xla|vsto|ppam|ppa)$/
OR TargetDirectory = /(?i)(Microsoft\\Word\\STARTUP|Microsoft\\Excel\\XLSTART|Microsoft\\AddIns|Microsoft\\Office\\AddIns)/
| ImageFileName != /(?i)(winword|excel|powerpnt|outlook|OfficeClickToRun|msiexec|OfficeC2RClient)\.exe/
| rename(field="TargetFileName", as="Indicator")
| detection_type := "Office_AddIn_File_Drop"
// Branch 2: Registry-based add-in registration
| union {
#event_simpleName = "RegGenericValueUpdate"
OR #event_simpleName = "RegValueUpdate"
| RegObjectName = /(?i)(Excel|Word|Outlook|PowerPoint)\\.*Addin/
| rename(field="RegObjectName", as="Indicator")
| detection_type := "Office_AddIn_Registry_Registration"
}
// Branch 3: Office processes loading add-in DLLs from non-standard paths
| union {
#event_simpleName = "ClassifiedModuleLoad"
OR #event_simpleName = "SuspiciousImageLoad"
| ImageFileName = /(?i)(winword|excel|powerpnt|outlook)\.exe/
| (
ModuleFileName = /(?i)\.(wll|xll)/
OR ModuleDirectoryName = /(?i)(\\Users\\|\\Temp\\|\\AppData\\|\\Downloads\\)/
)
| ModuleDirectoryName != /(?i)(\\Microsoft Office\\|\\Program Files\\Microsoft Office\\)/
| rename(field="ModuleFileName", as="Indicator")
| detection_type := "Office_AddIn_DLL_Load"
}
| table(
[@timestamp, ComputerName, UserName, detection_type, Indicator,
ImageFileName, CommandLine, ParentImageFileName],
limit=1000
)
| sort(field="@timestamp", order=desc)CrowdStrike LogScale (CQL) detection for T1137.006 Office add-in persistence using Falcon endpoint telemetry. Detects add-in file writes to Office startup directories, registry-based COM/VSTO add-in registration, and suspicious DLL loads by Office processes from user-writable paths. Uses union to combine three independent detection branches.
Data Sources
Required Tables
False Positives & Tuning
- CrowdStrike Falcon sensor itself or the Falcon Spotlight module may generate module load events when scanning DLLs loaded by Office processes during vulnerability assessment scans
- Microsoft 365 Click-to-Run (OfficeClickToRun.exe) and Office update mechanisms writing .xla or .xlam files during channel update operations — particularly when update staging places files temporarily in AppData before moving to final Office install path
- Third-party Office automation tools used in RPA (Robotic Process Automation) environments such as UiPath or Blue Prism that load Office COM add-ins programmatically from non-standard directories as part of attended or unattended bot workflows
Other platforms for T1137.006
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Drop WLL File to Word Startup Directory
Expected signal: Sysmon EventCode 11: FileCreate with TargetFilename ending in .wll in the Word STARTUP path, Image=powershell.exe. If Word is subsequently launched, Sysmon EventCode 7 would show the WLL being loaded.
- Test 2Register COM Add-in in Office Registry
Expected signal: Sysmon EventCode 12/13: RegistryKeyCreate and RegistryValueSet for HKCU\Software\Microsoft\Office\16.0\Excel\Addins\df00tech.TestAddIn with LoadBehavior=3.
- Test 3Create XLAM Add-in File (Excel Add-in)
Expected signal: Sysmon EventCode 11: FileCreate with TargetFilename ending in .xlam in the Excel XLSTART path, Image=powershell.exe.
References (5)
- https://attack.mitre.org/techniques/T1137/006/
- https://web.archive.org/web/20190526112859/https://labs.mwrinfosecurity.com/blog/add-in-opportunities-for-office-persistence/
- https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/
- https://www.welivesecurity.com/en/eset-research/to-the-moon-and-back-again-turlas-lunar-landing-in-diplomatic-missions/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1137.006/T1137.006.md
Unlock Pro Content
Get the full detection package for T1137.006 including response playbook, investigation guide, and atomic red team tests.