huntrule

PowerShell ScriptBlock Invokes Office RegisterXLL via COM Automation

Detects PowerShell Script Block content that uses COM automation to call .RegisterXLL for an Office XLL add-in.

FreeUnreviewedSigmahighv1
title: PowerShell ScriptBlock Invokes Office RegisterXLL via COM Automation
id: 1659b964-047b-4d8e-a236-fa935b31727f
status: test
description: This rule flags PowerShell script blocks that contain patterns consistent with registering a Microsoft Office XLL add-in through COM automation. Attackers can use this technique to extend Office functionality and establish persistence on a compromised host. The detection relies on Script Block logging content, matching specific string fragments tied to COM object creation and the RegisterXLL call.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1137.006/T1137.006.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_office_comobject_registerxll.yml
author: frack113, Huntrule Team
date: 2021-12-28
tags:
  - attack.persistence
  - attack.t1137.006
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - "new-object "
      - "-ComObject "
      - .application
      - .RegisterXLL
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 36fbec91-fa1b-4d5d-8df1-8d8edcb632ad
    type: derived

What it detects

This rule flags PowerShell script blocks that contain patterns consistent with registering a Microsoft Office XLL add-in through COM automation. Attackers can use this technique to extend Office functionality and establish persistence on a compromised host. The detection relies on Script Block logging content, matching specific string fragments tied to COM object creation and the RegisterXLL call.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.