huntrule

Windows Office Startup Folder File Creation with Uncommon Extension

Detects unusual-extension files created in Word/Excel startup folders on Windows, potentially supporting automatic Office loading.

FreeReviewedSigma · High · v2
Product
windows
Category
file_event
Author
frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-06-05
Updated
2026-07-31
AnalysisDetection
title: Windows Office Startup Folder File Creation with Uncommon Extension
id: 40b86648-225c-4036-b1f2-ce27a1991c5a
status: test
description: This rule flags creation of a new file in Microsoft Word or Excel startup folders when the target filename has an extension not in the approved/common set. An attacker may use these startup locations to ensure Office processes load malicious content or templates during user activity. The detection relies on Windows file event telemetry that includes TargetFilename and the creating process Image, with additional exclusions for Click-to-Run and standard Office binaries.
references:
  - https://app.any.run/tasks/d6fe6624-6ef8-485d-aa75-3d1bdda2a08c/
  - http://addbalance.com/word/startup.htm
  - https://answers.microsoft.com/en-us/msoffice/forum/all/document-in-word-startup-folder-doesnt-open-when/44ab0932-2917-4150-8cdc-2f2cf39e86f3
  - https://en.wikipedia.org/wiki/List_of_Microsoft_Office_filename_extensions
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_uncommon_file_startup.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-05
modified: 2023-12-13
tags:
  - attack.resource-development
  - attack.t1587.001
logsource:
  product: windows
  category: file_event
detection:
  selection_word_paths:
    - TargetFilename|contains: \Microsoft\Word\STARTUP
    - TargetFilename|contains|all:
        - \Office
        - \Program Files
        - \STARTUP
  filter_exclude_word_ext:
    TargetFilename|endswith:
      - .docb
      - .docm
      - .docx
      - .dotm
      - .mdb
      - .mdw
      - .pdf
      - .wll
      - .wwl
  selection_excel_paths:
    - TargetFilename|contains: \Microsoft\Excel\XLSTART
    - TargetFilename|contains|all:
        - \Office
        - \Program Files
        - \XLSTART
  filter_exclude_excel_ext:
    TargetFilename|endswith:
      - .xll
      - .xls
      - .xlsm
      - .xlsx
      - .xlt
      - .xltm
      - .xlw
  filter_main_office_click_to_run:
    Image|contains: :\Program Files\Common Files\Microsoft Shared\ClickToRun\
    Image|endswith: \OfficeClickToRun.exe
  filter_main_office_apps:
    Image|contains:
      - :\Program Files\Microsoft Office\
      - :\Program Files (x86)\Microsoft Office\
    Image|endswith:
      - \winword.exe
      - \excel.exe
  condition: ((selection_word_paths and not filter_exclude_word_ext) or (selection_excel_paths and not filter_exclude_excel_ext)) and not 1 of filter_main_*
falsepositives:
  - False positive might stem from rare extensions used by other Office utilities.
level: high
license: DRL-1.1
related:
  - id: a10a2c40-2c4d-49f8-b557-1a946bc55d9d
    type: derived