Windows Microsoft Word Loads .wll Add-In Files

Flags Microsoft Word loading a .wll add-in module on Windows using image load telemetry.

FreeUnreviewedSigmalowv1

windows-microsoft-word-loads-wll-add-in-files-1337afba

title: Windows Microsoft Word Loads .wll Add-In Files
id: 1d46738e-fafc-4a02-91fb-d07a81394bc6
status: test
description: This rule identifies when Microsoft Word (winword.exe) loads an Add-In file with a .wll extension. Loading .wll modules is a common tactic for establishing malicious functionality within Office applications, supporting initial access or persistence. It relies on process image load telemetry that includes the loaded module path and file extension.
references:
  - https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence
  - https://nored0x.github.io/red-teaming/office-persistence/#what-is-a-wll-file
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/image_load/image_load_office_word_wll_load.yml
author: Steffen Rogge (dr0pd34d), Huntrule Team
date: 2024-07-10
tags:
  - attack.execution
  - attack.t1204.002
  - detection.threat-hunting
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \winword.exe
    ImageLoaded|endswith: .wll
  condition: selection
falsepositives:
  - The rules is only looking for ".wll" loads. So some false positives are expected with legitimate and allowed WLLs.
level: low
license: DRL-1.1
related:
  - id: 1337afba-d17d-4d23-bd55-29b927603b30
    type: derived

What it detects

This rule identifies when Microsoft Word (winword.exe) loads an Add-In file with a .wll extension. Loading .wll modules is a common tactic for establishing malicious functionality within Office applications, supporting initial access or persistence. It relies on process image load telemetry that includes the loaded module path and file extension.

Known false positives

The rules is only looking for ".wll" loads. So some false positives are expected with legitimate and allowed WLLs.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.