Potential Persistence Via Microsoft Office Add-In

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•2

Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel).