Techniques › T1137 › T1137.006

T1137.006 Add-ins

persistence — Windows, Office Suite · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

• DET0050 Detect Persistence via Malicious Office Add-ins v1.0
  AN0137 Windows

  An adversary writes or drops a malicious Office Add-in (e.g., WLL, XLL, COM) to a trusted directory or modifies registry keys to load malicious add-ins on Office application launch. Upon user opening Word or Excel, the add-in is automatically loaded, triggering execution of the payload, often spawning scripting engines or anomalous child processes.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=2 → DC0061 File Modification

  WinEventLog:Sysmon EventCode=13, 14 → DC0063 Windows Registry Key Modification

  Tunable: AddInExtension TrustedPath RegistryPath ChildProcessName TimeWindow
  AN0138 Office Suite

  Malicious Office add-ins loaded via VSTO, COM, or VBA auto-load paths. Upon launch of Word/Excel/Outlook, the add-in executes code without user action. Add-in resides in trusted directory or registered via Office COM/VBE subsystem. Behavior includes unsigned add-in execution, anomalous load context, or add-in spawning interpreter process.

  WinEventLog:Application Office Add-in load errors, abnormal loading context, or unsigned add-in warnings → DC0038 Application Log Content

  WinEventLog:Microsoft-Office/OutlookAddinMonitor Outlook loading add-in via unexpected load path or non-default profile context → DC0064 Command Execution

  Tunable: UnsignedAddInBehavior OfficeProductVersion AddInTrigger

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1137.006

Rules tagged at the parent level (attack.t1137) 9

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.