Detect Add-ins in Sumo Logic CSE
Adversaries abuse Microsoft Office add-ins to achieve persistence. Add-ins (WLL/XLL for Word/Excel, COM add-ins, VSTO add-ins, Outlook add-ins) are loaded automatically when the corresponding Office application starts. Bisonal malware used .wll files dropped in Word startup; Naikon APT used intel.wll via RoyalRoad; Turla's LunarLoader and LunarMail use Outlook add-ins. XLL add-ins are particularly dangerous as they can execute arbitrary code when loaded and can be delivered via email attachments.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1137 Office Application Startup
- Sub-technique
- T1137.006 Add-ins
- Canonical reference
- https://attack.mitre.org/techniques/T1137/006/
Sumo Detection Query
// Part 1: Office Add-in File Drops
(_sourceCategory="*windows*sysmon*" OR _sourceCategory="*endpoint*sysmon*")
| where EventID = 11
| parse regex field=TargetFilename "(?i)(?P<filename>[^\\]+)$"
| where (
TargetFilename matches /(?i)\.(wll|xll|xlam|xla|vsto|ppam|ppa)$/
OR TargetFilename matches /(?i)(Microsoft\\Word\\STARTUP|Microsoft\\Excel\\XLSTART|Microsoft\\AddIns|Microsoft\\Office\\AddIns)/
)
AND !(Image matches /(?i)(winword|excel|powerpnt|outlook|OfficeClickToRun|msiexec|OfficeC2RClient)\.exe/)
| fields _messageTime, Computer, User, TargetFilename, Image, CommandLine
| withtime _messageTime
| eval detection_type = "Office_AddIn_File_Drop"
// Part 2: Add-in Registry Registration
| union (
(_sourceCategory="*windows*sysmon*" OR _sourceCategory="*endpoint*sysmon*")
| where EventID = 13
| where TargetObject matches /(?i)(Excel|Word|Outlook|PowerPoint)\\.*Addin/
| fields _messageTime, Computer, User, TargetObject, Details, Image, CommandLine
| withtime _messageTime
| eval detection_type = "Office_AddIn_Registry_Registration"
)
// Part 3: Office Processes Loading Add-in DLLs from Anomalous Paths
| union (
(_sourceCategory="*windows*sysmon*" OR _sourceCategory="*endpoint*sysmon*")
| where EventID = 7
| where Image matches /(?i)(winword|excel|powerpnt|outlook)\.exe/
| where ImageLoaded matches /(?i)\.(wll|xll)/
OR ImageLoaded matches /(?i)(\\Users\\|\\Temp\\|\\AppData\\|\\Downloads\\)/
| where !(ImageLoaded matches /(?i)(\\Microsoft Office\\|\\Program Files\\Microsoft Office\\)/)
| fields _messageTime, Computer, User, ImageLoaded, Image, CommandLine
| withtime _messageTime
| eval detection_type = "Office_AddIn_DLL_Load"
)
| count by _messageTime, Computer, User, detection_type, Image, CommandLine
| sort by _messageTime descSumo Logic CSE query detecting T1137.006 Office add-in persistence across three Sysmon event types: file creation in Office startup directories (EID 11), registry add-in key modification (EID 13), and Office process DLL loads from non-standard paths (EID 7). Uses union to combine all three detection branches into a single result set.
Data Sources
Required Tables
False Positives & Tuning
- Software deployment pipelines using tools like Chef, Puppet, or Ansible that write add-in configuration files to Office directories as part of automated workstation configuration management
- Security awareness training platforms (KnowBe4, Proofpoint Security Awareness) that install Outlook add-ins for phishing simulation reporting buttons, triggering registry events under Outlook\Addins
- Macro-enabled Excel workbooks used in finance departments that dynamically register .xlam add-ins at runtime, causing Office processes to load add-in DLLs from user profile directories
Other platforms for T1137.006
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Drop WLL File to Word Startup Directory
Expected signal: Sysmon EventCode 11: FileCreate with TargetFilename ending in .wll in the Word STARTUP path, Image=powershell.exe. If Word is subsequently launched, Sysmon EventCode 7 would show the WLL being loaded.
- Test 2Register COM Add-in in Office Registry
Expected signal: Sysmon EventCode 12/13: RegistryKeyCreate and RegistryValueSet for HKCU\Software\Microsoft\Office\16.0\Excel\Addins\df00tech.TestAddIn with LoadBehavior=3.
- Test 3Create XLAM Add-in File (Excel Add-in)
Expected signal: Sysmon EventCode 11: FileCreate with TargetFilename ending in .xlam in the Excel XLSTART path, Image=powershell.exe.
References (5)
- https://attack.mitre.org/techniques/T1137/006/
- https://web.archive.org/web/20190526112859/https://labs.mwrinfosecurity.com/blog/add-in-opportunities-for-office-persistence/
- https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/
- https://www.welivesecurity.com/en/eset-research/to-the-moon-and-back-again-turlas-lunar-landing-in-diplomatic-missions/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1137.006/T1137.006.md
Unlock Pro Content
Get the full detection package for T1137.006 including response playbook, investigation guide, and atomic red team tests.