{"id":"T1137.006","name":"Add-ins","url":"https://attack.mitre.org/techniques/T1137/006","tactics":["persistence"],"platforms":["Windows","Office Suite"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0050","stix_id":"x-mitre-detection-strategy--53144b02-d6b1-42de-b5cf-e785a59c43bd","name":"Detect Persistence via Malicious Office Add-ins","url":"https://attack.mitre.org/detectionstrategies/DET0050","analytics":[{"id":"AN0137","stix_id":"x-mitre-analytic--7263a8a8-a06f-4bdc-a021-3529ad683f9d","name":"Analytic 0137","description":"An adversary writes or drops a malicious Office Add-in (e.g., WLL, XLL, COM) to a trusted directory or modifies registry keys to load malicious add-ins on Office application launch. Upon user opening Word or Excel, the add-in is automatically loaded, triggering execution of the payload, often spawning scripting engines or anomalous child processes.","url":"https://attack.mitre.org/detectionstrategies/DET0050#AN0137","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=2","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"AddInExtension","description":"Malicious add-ins may have varying extensions (.wll, .xll, .dll, .vsto)"},{"field":"TrustedPath","description":"Office trusted add-in paths may differ across enterprise configurations"},{"field":"RegistryPath","description":"Registry keys used to load add-ins may be version- and app-specific"},{"field":"ChildProcessName","description":"Office processes spawning mshta.exe, powershell.exe, or rundll32.exe are abnormal"},{"field":"TimeWindow","description":"Add-in loading may occur only during Office launch windows"}],"live":true,"detection_strategies":["DET0050"],"techniques":["T1137.006"]},{"id":"AN0138","stix_id":"x-mitre-analytic--9ad4670e-f336-454f-960e-4f2f611f3657","name":"Analytic 0138","description":"Malicious Office add-ins loaded via VSTO, COM, or VBA auto-load paths. Upon launch of Word/Excel/Outlook, the add-in executes code without user action. Add-in resides in trusted directory or registered via Office COM/VBE subsystem. Behavior includes unsigned add-in execution, anomalous load context, or add-in spawning interpreter process.","url":"https://attack.mitre.org/detectionstrategies/DET0050#AN0138","platforms":["Office Suite"],"log_source_references":[{"name":"WinEventLog:Application","channel":"Office Add-in load errors, abnormal loading context, or unsigned add-in warnings","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"wineventlog-application"},{"name":"WinEventLog:Microsoft-Office/OutlookAddinMonitor","channel":"Outlook loading add-in via unexpected load path or non-default profile context","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-microsoft-office-outlookaddinmonitor"}],"mutable_elements":[{"field":"UnsignedAddInBehavior","description":"Admins may allow or block unsigned add-ins depending on GPO configuration"},{"field":"OfficeProductVersion","description":"Different Office versions store trusted paths and add-in configs in version-specific locations"},{"field":"AddInTrigger","description":"Some add-ins only load on specific actions (new document, open file, etc.)"}],"live":true,"detection_strategies":["DET0050"],"techniques":["T1137.006"]}],"live":true,"version":"1.0","techniques":["T1137.006"]}],"sigma_rules":[{"id":"36fbec91-fa1b-4d5d-8df1-8d8edcb632ad","title":"Code Executed Via Office Add-in XLL File","author":"frack113","status":"test","level":"high","date":"2021-12-28","modified":null,"description":"Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system.\nOffice add-ins can be used to add functionality to Office programs\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1137.006/T1137.006.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.persistence","attack.t1137.006"],"path":"rules/windows/powershell/powershell_script/posh_ps_office_comobject_registerxll.yml","techniques":["T1137.006"],"cves":[]},{"id":"8e1cb247-6cf6-42fa-b440-3f27d57e9936","title":"Potential Persistence Via Microsoft Office Add-In","author":"NVISO","status":"test","level":"high","date":"2020-05-11","modified":"2023-02-08","description":"Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel).","references":["Internal Research","https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence","https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.persistence","attack.t1137.006"],"path":"rules/windows/file/file_event/file_event_win_office_addin_persistence.yml","techniques":["T1137.006"],"cves":[]},{"id":"961e33d1-4f86-4fcf-80ab-930a708b2f82","title":"Potential Persistence Via Excel Add-in - Registry","author":"frack113","status":"test","level":"high","date":"2023-01-15","modified":"2023-08-17","description":"Detect potential persistence via the creation of an excel add-in (XLL) file to make it run automatically when Excel is started.","references":["https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md","https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.t1137.006"],"path":"rules/windows/registry/registry_set/registry_set_persistence_xll.yml","techniques":["T1137.006"],"cves":[]},{"id":"9d15044a-7cfe-4d23-8085-6ebc11df7685","title":"Potential Persistence Via Visual Studio Tools for Office","author":"Bhabesh Raj","status":"test","level":"medium","date":"2021-01-10","modified":"2026-01-09","description":"Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.","references":["https://twitter.com/_vivami/status/1347925307643355138","https://vanmieghem.io/stealth-outlook-persistence/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.t1137.006","attack.persistence"],"path":"rules/windows/registry/registry_set/registry_set_persistence_office_vsto.yml","techniques":["T1137.006"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}