Potential Persistence Via Excel Add-in - Registry

Rule Info

Name
Potential Persistence Via Excel Add-in - Registry
Description
Detect potential persistence via the creation of an excel add-in (XLL) file to make it run automatically when Excel is started.
Reference
https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md
Modified
None
Date
2023-01-15 00:00:00
Author
frack113
Tags
attack.persistence DEMO attack.t1137.006
Id
961e33d1-4f86-4fcf-80ab-930a708b2f82
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=961e33d1-4f86-4fcf-80ab-930a708b2f82

Rule History

Author
Commit
Title
Date
Qasim Qlf
4938f9b44
Rename registry_set_persistance_xll.yml to registry_set_persistence_xll.yml
2023-01-30
Nasreddine Bencherchali
679207b6c
fix: update metadata
2023-01-16
frack113
c3f285d94
Add redcannary rules
2023-01-15
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022