Potential Persistence Via Excel Add-in - Registry

Rule Info

Name
Potential Persistence Via Excel Add-in - Registry
Description
Detect potential persistence via the creation of an excel add-in (XLL) file to make it run automatically when Excel is started.
Modified
None
Date
2023-01-15 00:00:00
Author
frack113
Tags
attack.persistence DEMO attack.t1137.006
Id
961e33d1-4f86-4fcf-80ab-930a708b2f82
Type
Community Rule

Rule History

Author
Commit
Title
Date
Qasim Qlf
Rename registry_set_persistance_xll.yml to registry_set_persistence_xll.yml
2023-01-30
Nasreddine Bencherchali
fix: update metadata
2023-01-16
frack113
Add redcannary rules
2023-01-15