Windows Office Startup Folder File Drop for Persistence via Office Documents
Alerts when Office documents/templates are created in Word/Excel startup folders on Windows, suggesting persistence attempts.
- Product
- windows
- Category
- file_event
- Author
- Max Altgelt (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-06-02
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies creation of Microsoft Office documents in default Word or Excel startup folder paths that can be used to trigger persistent execution when Office loads templates or documents. Attackers may leverage these locations to establish persistence using Office file types, relying on Windows file event telemetry and matching target filename path and extension patterns. It excludes activity where the initiating image is WINWORD.exe or EXCEL.exe to reduce noise from legitimate Office operations.
Reporting behind it
- insight-jp.nttsecurity.comhttps://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanese-companies
- learn.microsoft.comhttps://learn.microsoft.com/en-us/office/troubleshoot/excel/use-startup-folders
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_startup_persistence.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Office Startup Folder File Drop for Persistence via Office Documents
id: c8555838-3658-48e9-bca3-9091d03a0ce8
status: test
description: This rule identifies creation of Microsoft Office documents in default Word or Excel startup folder paths that can be used to trigger persistent execution when Office loads templates or documents. Attackers may leverage these locations to establish persistence using Office file types, relying on Windows file event telemetry and matching target filename path and extension patterns. It excludes activity where the initiating image is WINWORD.exe or EXCEL.exe to reduce noise from legitimate Office operations.
references:
- https://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanese-companies
- https://learn.microsoft.com/en-us/office/troubleshoot/excel/use-startup-folders
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_startup_persistence.yml
author: Max Altgelt (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-02
modified: 2023-06-22
tags:
- attack.persistence
- attack.t1137
logsource:
category: file_event
product: windows
detection:
selection_word_paths:
- TargetFilename|contains: \Microsoft\Word\STARTUP
- TargetFilename|contains|all:
- \Office
- \Program Files
- \STARTUP
selection_word_extension:
TargetFilename|endswith:
- .doc
- .docm
- .docx
- .dot
- .dotm
- .rtf
selection_excel_paths:
- TargetFilename|contains: \Microsoft\Excel\XLSTART
- TargetFilename|contains|all:
- \Office
- \Program Files
- \XLSTART
selection_excel_extension:
TargetFilename|endswith:
- .xls
- .xlsm
- .xlsx
- .xlt
- .xltm
filter_main_office:
Image|endswith:
- \WINWORD.exe
- \EXCEL.exe
condition: (all of selection_word_* or all of selection_excel_*) and not filter_main_office
falsepositives:
- Loading a user environment from a backup or a domain controller
- Synchronization of templates
level: high
license: DRL-1.1
related:
- id: 0e20c89d-2264-44ae-8238-aeeaba609ece
type: derived