Suspicious Office Add-ins Execution

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the execution of office add-ins from suspicious locations or suspicious parent. The office add-on can be abused for persistence and execution of malicious code. Threat actors often use these malicious add-ins to gain initial access, typically delivered through phishing emails with malicious Office documents.

2025-05-05 00:00:00

None

2d791965-eafa-4b7b-a638-9dc04aa33989

attack.persistence attack.t1137.006 attack.execution

Nextron Sigma feed only (private)