Add-in dropped into a Word or Excel automatic startup folder

1title: Add-in dropped into a Word or Excel automatic startup folder2id: 6ec36e84-a40b-4ecc-aa7e-37f64b1645793status: experimental4description: |5  Detects a loadable Office file appearing in one of the two folders whose6  contents Word and Excel open automatically at launch, which is the file-drop7  half of AN0137 and the part that survives without any registry write. The two8  folders are matched as separate arms, each paired with the extensions its own9  application loads, because a `.dotm` in XLSTART or a `.xlam` in the Word10  STARTUP folder is inert — a path list AND-ed against one shared extension list11  would report those crossed pairs as persistence. Excel's arm carries the macro12  workbook types (`.xlsm`, `.xls`, `.xlsb`, `.xltm`) as well as the add-in types,13  since XLSTART opens every workbook it contains and runs `Workbook_Open` /14  `Auto_Open` in it; `PERSONAL.XLSB` is filtered by name rather than by dropping15  the whole extension, because that one file is what Excel writes when a user16  records their first macro. `.xll` is included for completeness — Excel is17  normally pointed at an XLL through the `OPEN=` registry values or the Add-ins18  manager rather than by finding one in XLSTART. `.ppam` is absent: PowerPoint19  has no startup folder of this kind and registers add-ins only in the registry,20  so a `.ppam` written to either matched folder would not load. The user AddIns21  folder is also excluded, since a file there does nothing until it is registered22  in the Office Options keys. `\XLSTART\` is matched unanchored because that23  folder name is distinctive and appears in both the per-user and the Office24  install-root copies; the Word term is anchored to `\Microsoft\Word\STARTUP\`25  and therefore covers the per-user folder only, since the install-root26  equivalent sits under a version-numbered `...\root\OfficeNN\STARTUP\` path that27  cannot be written without guessing the release. Extensions here populate28  MITRE's AddInExtension knob; the values are ours. The lock-file filter removes29  the `~$` shadow files Office itself creates beside an open template.30  Prerequisite: Sysmon is not present in a default install, and the widely used31  shipped configurations trim EventID 11 down to a small extension set that does32  not include `.wll` or `.xlam` — confirm these folders are in scope before33  reading an empty result as clean. The analytic's other arms — the registry load34  path and the abnormal Office child process — are separate events and are not35  modelled here, and this rule cannot show that a dropped file ever loaded.36  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0050, not hand-written and not tested by its author. Any lab result is on this rule's own page.37references:38  - https://attack.mitre.org/techniques/T1137/00639  - https://attack.mitre.org/detectionstrategies/DET005040author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)41date: 2026-08-1642tags:43  - attack.persistence44  - attack.t1137.00645logsource:46  category: file_event47  product: windows48detection:49  selection_word_startup:50    TargetFilename|contains: '\Microsoft\Word\STARTUP\'51    TargetFilename|endswith:52      - '.wll'53      - '.dotm'54      - '.dot'55  selection_excel_xlstart:56    TargetFilename|contains: '\XLSTART\'57    TargetFilename|endswith:58      - '.xll'59      - '.xlam'60      - '.xla'61      - '.xlsm'62      - '.xlsb'63      - '.xls'64      - '.xltm'65  filter_office_lock_files:66    TargetFilename|contains: '\~$'67  filter_personal_macro_workbook:68    TargetFilename|endswith: '\PERSONAL.XLSB'69  condition: 1 of selection_* and not filter_office_lock_files and not filter_personal_macro_workbook70falsepositives:71  - "Add-ins deployed on purpose — a corporate reporting or compliance .xlam pushed by Group Policy or a software-distribution package, or a vendor product that installs a .wll during setup. The rule cannot tell a sanctioned add-in from a dropped one, so these are its main volume, and MITRE's TrustedPath knob is where an estate records the deployment paths and filenames it has approved."72  - "Users installing an add-in themselves from a download or a colleague, which in finance and engineering teams is routine and lands in exactly these folders."73  - "Profile roaming and folder sync. Office repair runs, version upgrades, roaming profiles and OneDrive Known Folder Move all re-materialise the contents of STARTUP and XLSTART, and Known Folder Move in particular produces a burst of creates per user on every first logon to a new machine with no install activity behind it."74  - "Backup, endpoint-protection and search-indexing agents that write a temporary copy of an add-in back into the same folder while scanning or restoring it, producing a file-create event with no user action behind it."75  - "Shared macro workbooks other than PERSONAL.XLSB. Teams that distribute a departmental .xlsm or .xltm into XLSTART so it opens for everyone will match the Excel arm on every deployment and every update."76level: medium