Techniques › T1137.006 › AN0137
AN0137 Analytic 0137
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>An adversary writes or drops a malicious Office Add-in (e.g., WLL, XLL, COM) to a trusted directory or modifies registry keys to load malicious add-ins on Office application launch. Upon user opening Word or Excel, the add-in is automatically loaded, triggering execution of the payload, often spawning scripting engines or anomalous child processes.</p>
- Detects
- T1137.006 Add-ins
- Part of
- DET0050 Detect Persistence via Malicious Office Add-ins
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Sysmon | EventCode=2 | DC0061 File Modification |
| WinEventLog:Sysmon | EventCode=13, 14 | DC0063 Windows Registry Key Modification |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AddInExtension | Malicious add-ins may have varying extensions (.wll, .xll, .dll, .vsto) |
TrustedPath | Office trusted add-in paths may differ across enterprise configurations |
RegistryPath | Registry keys used to load add-ins may be version- and app-specific |
ChildProcessName | Office processes spawning mshta.exe, powershell.exe, or rundll32.exe are abnormal |
TimeWindow | Add-in loading may occur only during Office launch windows |