Techniques › T1137.006 › AN0138
AN0138 Analytic 0138
Office Suite · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Malicious Office add-ins loaded via VSTO, COM, or VBA auto-load paths. Upon launch of Word/Excel/Outlook, the add-in executes code without user action. Add-in resides in trusted directory or registered via Office COM/VBE subsystem. Behavior includes unsigned add-in execution, anomalous load context, or add-in spawning interpreter process.</p>
- Detects
- T1137.006 Add-ins
- Part of
- DET0050 Detect Persistence via Malicious Office Add-ins
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Application | Office Add-in load errors, abnormal loading context, or unsigned add-in warnings | DC0038 Application Log Content |
| WinEventLog:Microsoft-Office/OutlookAddinMonitor | Outlook loading add-in via unexpected load path or non-default profile context | DC0064 Command Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
UnsignedAddInBehavior | Admins may allow or block unsigned add-ins depending on GPO configuration |
OfficeProductVersion | Different Office versions store trusted paths and add-in configs in version-specific locations |
AddInTrigger | Some add-ins only load on specific actions (new document, open file, etc.) |