Windows Office Startup Folder File Creation with Uncommon Extension
Detects unusual-extension files created in Word/Excel startup folders on Windows, potentially supporting automatic Office loading.
- Product
- windows
- Category
- file_event
- Author
- frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-06-05
- Updated
- 2026-07-31
ATT&CK techniques
Resource DevRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags creation of a new file in Microsoft Word or Excel startup folders when the target filename has an extension not in the approved/common set. An attacker may use these startup locations to ensure Office processes load malicious content or templates during user activity. The detection relies on Windows file event telemetry that includes TargetFilename and the creating process Image, with additional exclusions for Click-to-Run and standard Office binaries.
Reporting behind it
- app.any.runhttps://app.any.run/tasks/d6fe6624-6ef8-485d-aa75-3d1bdda2a08c/
- addbalance.comhttp://addbalance.com/word/startup.htm
- answers.microsoft.comhttps://answers.microsoft.com/en-us/msoffice/forum/all/document-in-word-startup-folder-doesnt-open-when/44ab0932-2917-4150-8cdc-2f2cf39e86f3
- en.wikipedia.orghttps://en.wikipedia.org/wiki/List_of_Microsoft_Office_filename_extensions
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_uncommon_file_startup.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Office Startup Folder File Creation with Uncommon Extension
id: 40b86648-225c-4036-b1f2-ce27a1991c5a
status: test
description: This rule flags creation of a new file in Microsoft Word or Excel startup folders when the target filename has an extension not in the approved/common set. An attacker may use these startup locations to ensure Office processes load malicious content or templates during user activity. The detection relies on Windows file event telemetry that includes TargetFilename and the creating process Image, with additional exclusions for Click-to-Run and standard Office binaries.
references:
- https://app.any.run/tasks/d6fe6624-6ef8-485d-aa75-3d1bdda2a08c/
- http://addbalance.com/word/startup.htm
- https://answers.microsoft.com/en-us/msoffice/forum/all/document-in-word-startup-folder-doesnt-open-when/44ab0932-2917-4150-8cdc-2f2cf39e86f3
- https://en.wikipedia.org/wiki/List_of_Microsoft_Office_filename_extensions
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_uncommon_file_startup.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-05
modified: 2023-12-13
tags:
- attack.resource-development
- attack.t1587.001
logsource:
product: windows
category: file_event
detection:
selection_word_paths:
- TargetFilename|contains: \Microsoft\Word\STARTUP
- TargetFilename|contains|all:
- \Office
- \Program Files
- \STARTUP
filter_exclude_word_ext:
TargetFilename|endswith:
- .docb
- .docm
- .docx
- .dotm
- .mdb
- .mdw
- .pdf
- .wll
- .wwl
selection_excel_paths:
- TargetFilename|contains: \Microsoft\Excel\XLSTART
- TargetFilename|contains|all:
- \Office
- \Program Files
- \XLSTART
filter_exclude_excel_ext:
TargetFilename|endswith:
- .xll
- .xls
- .xlsm
- .xlsx
- .xlt
- .xltm
- .xlw
filter_main_office_click_to_run:
Image|contains: :\Program Files\Common Files\Microsoft Shared\ClickToRun\
Image|endswith: \OfficeClickToRun.exe
filter_main_office_apps:
Image|contains:
- :\Program Files\Microsoft Office\
- :\Program Files (x86)\Microsoft Office\
Image|endswith:
- \winword.exe
- \excel.exe
condition: ((selection_word_paths and not filter_exclude_word_ext) or (selection_excel_paths and not filter_exclude_excel_ext)) and not 1 of filter_main_*
falsepositives:
- False positive might stem from rare extensions used by other Office utilities.
level: high
license: DRL-1.1
related:
- id: a10a2c40-2c4d-49f8-b557-1a946bc55d9d
type: derived