Windows Registry: Excel Options Run Entry Point for XLL Add-in Persistence
Flags registry writes that reference an Excel XLL add-in via a '/R ' command under Excel Options.
- Product
- windows
- Category
- registry_set
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2023-01-15
- Updated
- 2026-07-30
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies registry modifications under the Microsoft Office Excel options path where the value data starts with '/R ' and ends with '.xll', indicating an Excel add-in (XLL) intended for automatic execution at Excel startup. Attackers may use an XLL to establish persistence through Office by leveraging Excel’s add-in loading behavior. The detection relies on Windows registry set telemetry that records the TargetObject and Details fields, including the command-like value contents.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md
- labs.withsecure.comhttps://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_xll.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: Excel Options Run Entry Point for XLL Add-in Persistence"
id: d9074ad0-ce08-4056-978a-f77b91c8f054
status: test
description: This rule identifies registry modifications under the Microsoft Office Excel options path where the value data starts with '/R ' and ends with '.xll', indicating an Excel add-in (XLL) intended for automatic execution at Excel startup. Attackers may use an XLL to establish persistence through Office by leveraging Excel’s add-in loading behavior. The detection relies on Windows registry set telemetry that records the TargetObject and Details fields, including the command-like value contents.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md
- https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_xll.yml
author: frack113, Huntrule Team
date: 2023-01-15
modified: 2023-08-17
tags:
- attack.persistence
- attack.t1137.006
logsource:
product: windows
category: registry_set
detection:
selection:
TargetObject|contains: Software\Microsoft\Office\
TargetObject|endswith: \Excel\Options
Details|startswith: "/R "
Details|endswith: .xll
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 961e33d1-4f86-4fcf-80ab-930a708b2f82
type: derived