Windows: Excel loads an .XLL add-in via excel.exe image load

Flags excel.exe loading a .XLL add-in module, an execution indicator for potential malicious add-in activity.

FreeUnreviewedSigmalowv1

windows-excel-loads-an-xll-add-in-via-excel-exe-image-load-c5f4b5cb

title: "Windows: Excel loads an .XLL add-in via excel.exe image load"
id: 14e62d9c-8221-498b-bb7c-51999b3c6222
status: test
description: This rule identifies when Microsoft Excel (excel.exe) loads an add-in file with a .xll extension. Loading .xll files can enable attackers to run code within the context of an Office process, making it a useful execution indicator. It relies on Windows image-load telemetry that records the process (excel.exe) and the loaded module path ending in .xll.
references:
  - https://www.mandiant.com/resources/blog/lnk-between-browsers
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/image_load/image_load_office_excel_xll_load.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-12
tags:
  - attack.execution
  - attack.t1204.002
  - detection.threat-hunting
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \excel.exe
    ImageLoaded|endswith: .xll
  condition: selection
falsepositives:
  - The rules is only looking for ".xll" loads. So some false positives are expected with legitimate and allowed XLLs
level: low
license: DRL-1.1
related:
  - id: c5f4b5cb-4c25-4249-ba91-aa03626e3185
    type: derived

What it detects

This rule identifies when Microsoft Excel (excel.exe) loads an add-in file with a .xll extension. Loading .xll files can enable attackers to run code within the context of an Office process, making it a useful execution indicator. It relies on Windows image-load telemetry that records the process (excel.exe) and the loaded module path ending in .xll.

Known false positives

The rules is only looking for ".xll" loads. So some false positives are expected with legitimate and allowed XLLs

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.