Windows: Microsoft Word Loads WLL Add-In Files
Flags Microsoft Word loading a .wll add-in module on Windows using image load telemetry.
FreeReviewedSigma · Low · v5
- Product
- windows
- Category
- image_load
- Author
- Steffen Rogge (dr0pd34d) (SigmaHQ), DRL 1.1
- Published
- 2024-07-10
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies when winword.exe loads a .wll file, indicating Microsoft Word Add-In execution. .wll files can be abused for initial access or persistence by running attacker-controlled code within the Office process. The detection relies on Windows image load telemetry that records the loaded module path ending in .wll from winword.exe.
Reporting behind it
- labs.withsecure.comhttps://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence
- nored0x.github.iohttps://nored0x.github.io/red-teaming/office-persistence/#what-is-a-wll-file
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/image_load/image_load_office_word_wll_load.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-microsoft-word-loads-wll-add-in-files-1337afba
title: "Windows: Microsoft Word Loads WLL Add-In Files"
id: 1d46738e-fafc-4a02-91fb-d07a81394bc6
status: test
description: This rule identifies when winword.exe loads a .wll file, indicating Microsoft Word Add-In execution. .wll files can be abused for initial access or persistence by running attacker-controlled code within the Office process. The detection relies on Windows image load telemetry that records the loaded module path ending in .wll from winword.exe.
references:
- https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence
- https://nored0x.github.io/red-teaming/office-persistence/#what-is-a-wll-file
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/image_load/image_load_office_word_wll_load.yml
author: Steffen Rogge (dr0pd34d), Huntrule Team
date: 2024-07-10
tags:
- attack.execution
- attack.t1204.002
- detection.threat-hunting
logsource:
category: image_load
product: windows
detection:
selection:
Image|endswith: \winword.exe
ImageLoaded|endswith: .wll
condition: selection
falsepositives:
- The rules is only looking for ".wll" loads. So some false positives are expected with legitimate and allowed WLLs.
level: low
license: DRL-1.1
related:
- id: 1337afba-d17d-4d23-bd55-29b927603b30
type: derived