Windows Registry: Excel Options Run Entry Point for XLL Add-in Persistence

title: "Windows Registry: Excel Options Run Entry Point for XLL Add-in Persistence"
id: d9074ad0-ce08-4056-978a-f77b91c8f054
status: test
description: This rule identifies registry modifications under the Microsoft Office Excel options path where the value data starts with '/R ' and ends with '.xll', indicating an Excel add-in (XLL) intended for automatic execution at Excel startup. Attackers may use an XLL to establish persistence through Office by leveraging Excel’s add-in loading behavior. The detection relies on Windows registry set telemetry that records the TargetObject and Details fields, including the command-like value contents.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md
  - https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_xll.yml
author: frack113, Huntrule Team
date: 2023-01-15
modified: 2023-08-17
tags:
  - attack.persistence
  - attack.t1137.006
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains: Software\Microsoft\Office\
    TargetObject|endswith: \Excel\Options
    Details|startswith: "/R "
    Details|endswith: .xll
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 961e33d1-4f86-4fcf-80ab-930a708b2f82
    type: derived