Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
26 detections
Filters
Last updated
All Time
Detection languages
15
9
1
1
Contributors
9
6
6
2
1
Categories
9
5
4
3
3
Platforms
18
6
2
1
1
Products / Services
5
4
3
3
3
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
1
IDS Classtypes
1
IDS Protocols
1
This rule detects the creation or modification of specific file types (.wll, .xll, .xlam, .xla, .ppam) in Microsoft Office startup or add-in directories. These files can be used to establish persistence by executing malicious code when Microsoft Office applications (Word, Excel, PowerPoint) are launched. The rule specifically targets paths associated with Word Startup, Excel Startup, Excel XLSTART, and generic Microsoft Addins folders.
This rule detects PowerShell script blocks that attempt to register an XLL (Excel Add-in) file using COM objects. Adversaries may abuse Microsoft Office add-ins, specifically XLL files, to establish persistence on a compromised system. The detection looks for the combination of 'new-object', '-ComObject', '.application', and '.RegisterXLL' within a PowerShell script block, indicating an attempt to programmatically register an XLL add-in.
Detects potential persistence by monitoring for modifications to the Excel Options registry key, specifically looking for the addition of an Excel Add-in (XLL) file that would cause it to run automatically when Excel starts. This technique is often used by adversaries to maintain access to a compromised system.
Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel).
Detect potential persistence via the creation of an excel add-in (XLL) file to make it run automatically when Excel is started.
Page 2 of 2