Windows Registry Persistence via VSTO Add-ins in Microsoft Office

title: Windows Registry Persistence via VSTO Add-ins in Microsoft Office
id: dd3eedfa-c86c-4aeb-af9d-e50c84d4b44e
status: test
description: This rule identifies persistence attempts where an Office add-in registered through Visual Studio Tools for Office (VSTO) appears in registry locations used by Outlook, Word, Excel, and PowerPoint add-ins. Attackers may use VSTO-style add-ins to execute code on Office startup and maintain long-term access. It relies on registry set telemetry for matching target registry paths related to Office/VSTO add-in inclusion, while excluding common installer and integration binaries to reduce benign installation noise.
references:
  - https://twitter.com/_vivami/status/1347925307643355138
  - https://vanmieghem.io/stealth-outlook-persistence/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_office_vsto.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-01-10
modified: 2026-01-09
tags:
  - attack.t1137.006
  - attack.persistence
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - \Software\Microsoft\Office\Outlook\Addins\
      - \Software\Microsoft\Office\Word\Addins\
      - \Software\Microsoft\Office\Excel\Addins\
      - \Software\Microsoft\Office\Powerpoint\Addins\
      - \Software\Microsoft\VSTO\Security\Inclusion\
  filter_main_system:
    Image:
      - C:\Windows\System32\msiexec.exe
      - C:\Windows\SysWOW64\msiexec.exe
      - C:\Windows\System32\regsvr32.exe
      - C:\Windows\SysWOW64\regsvr32.exe
  filter_main_office_click_to_run:
    Image|startswith:
      - C:\Program Files\Common Files (x86)\Microsoft Shared\ClickToRun\
      - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\
    Image|endswith: \OfficeClickToRun.exe
  filter_main_integrator:
    Image:
      - C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe
      - C:\Program Files\Microsoft Office\root\integration\integrator.exe
  filter_main_office_apps:
    Image|startswith:
      - C:\Program Files\Microsoft Office\OFFICE
      - C:\Program Files (x86)\Microsoft Office\OFFICE
      - C:\Program Files\Microsoft Office\Root\OFFICE
      - C:\Program Files (x86)\Microsoft Office\Root\OFFICE
      - C:\PROGRA~2\MICROS~2\Office
    Image|endswith:
      - \excel.exe
      - \Integrator.exe
      - \OneNote.exe
      - \outlook.exe
      - \powerpnt.exe
      - \Teams.exe
      - \visio.exe
      - \winword.exe
  filter_main_vsto:
    Image|startswith:
      - C:\Program Files\Common Files\Microsoft Shared\VSTO\
      - C:\Program Files (x86)\Microsoft Shared\VSTO\
    Image|endswith: \VSTOInstaller.exe
  filter_optional_avg:
    Image:
      - C:\Program Files\AVG\Antivirus\RegSvr.exe
      - C:\Program Files (x86)\AVG\Antivirus\RegSvr.exe
    TargetObject|contains: \Microsoft\Office\Outlook\Addins\Antivirus.AsOutExt\
  filter_optional_avast:
    Image:
      - C:\Program Files\Avast Software\Avast\RegSvr.exe
      - C:\Program Files (x86)\Avast Software\Avast\RegSvr.exe
    TargetObject|contains: \Microsoft\Office\Outlook\Addins\Avast.AsOutExt\
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate Addin Installation
level: medium
license: DRL-1.1
related:
  - id: 9d15044a-7cfe-4d23-8085-6ebc11df7685
    type: derived