Windows: Excel Loads .xll Add-In from Uncommon Path

Flags Excel loading .xll add-ins from uncommon directories based on image load paths.

FreeUnreviewedSigmamediumv1

windows-excel-loads-xll-add-in-from-uncommon-path-af4c4609

title: "Windows: Excel Loads .xll Add-In from Uncommon Path"
id: 7a67a622-3b0f-46ad-8f2d-e533ba74025d
related:
  - id: c5f4b5cb-4c25-4249-ba91-aa03626e3185
    type: derived
  - id: af4c4609-5755-42fe-8075-4effb49f5d44
    type: derived
status: test
description: This rule identifies when Microsoft Excel (excel.exe) loads an add-in file (.xll) from a path that matches one of several uncommon locations. Adversaries may abuse Excel add-ins to execute malicious code when they gain the ability to place or influence .xll files. The detection relies on Windows image load telemetry, specifically the loaded module path ending in .xll and containing path substrings such as \Desktop\, \Downloads\, \Temp\, and similar locations.
references:
  - https://www.mandiant.com/resources/blog/lnk-between-browsers
  - https://wazuh.com/blog/detecting-xll-files-used-for-dropping-fin7-jssloader-with-wazuh/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_office_excel_xll_susp_load.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-12
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \excel.exe
    ImageLoaded|contains:
      - \Desktop\
      - \Downloads\
      - \Perflogs\
      - \Temp\
      - \Users\Public\
      - \Windows\Tasks\
    ImageLoaded|endswith: .xll
  condition: selection
falsepositives:
  - Some tuning might be required to allow or remove certain locations used by the rule if you consider them as safe locations
level: medium
license: DRL-1.1

What it detects

This rule identifies when Microsoft Excel (excel.exe) loads an add-in file (.xll) from a path that matches one of several uncommon locations. Adversaries may abuse Excel add-ins to execute malicious code when they gain the ability to place or influence .xll files. The detection relies on Windows image load telemetry, specifically the loaded module path ending in .xll and containing path substrings such as \Desktop\, \Downloads\, \Temp\, and similar locations.

Known false positives

Some tuning might be required to allow or remove certain locations used by the rule if you consider them as safe locations

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.