Suspicious Execution via Microsoft Office Add-Ins

This detection rule identifies execution of common Microsoft Office applications (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE, MSACCESS.EXE, VSTOInstaller.exe) to launch an Office Add-In from a suspicious path or with an unusual parent process. The rule leverages process monitoring to detect when these Office applications load add-ins (wll, xll, ppa, ppam, xla, xlam, vsto) from locations like Temp directories, Downloads, or from unusual parent processes such as cmd.exe or powershell.exe. This activity may indicate an attempt to get initial access via a malicious phishing MS Office Add-In. The rule filters out known benign activities, such as Logitech software installations, VSTO uninstalls, and specific Rundll32.exe executions to minimize false positives, focusing on genuine anomalies indicative of malicious intent. The rule was last updated on 2026/04/07.

Attack Chain

1. The attacker sends a spearphishing email with a malicious Office document or a link to download one.
2. The victim opens the malicious Office document (e.g., Word, Excel, PowerPoint).
3. The Office application executes, triggering the download and execution of a malicious add-in (wll, xll, ppa, ppam, xla, xlam, vsto) from a suspicious location (e.g., %TEMP%, Downloads).
4. Alternatively, the user may be tricked into manually installing the add-in.
5. The add-in executes within the context of the Office application (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE, MSACCESS.EXE).
6. The malicious add-in performs malicious actions, such as downloading additional payloads, establishing command and control, or exfiltrating data.
7. The attacker leverages the compromised Office application and add-in for persistence and further exploitation.

Impact

A successful attack can lead to initial access within the targeted organization. The attacker can then leverage the compromised system for further malicious activities, including data theft, lateral movement, and the installation of ransomware. The use of Office Add-Ins allows attackers to bypass traditional security controls and blend in with legitimate Office activity. Because the rule detects add-in execution, the damage ranges from initial access to lateral movement and persistence depending on the attacker objectives.

Recommendation

• Enable process creation logging in Windows via Sysmon or Windows event logging to capture process execution details. This will activate the rules below.
• Deploy the Sigma rules provided to your SIEM to detect suspicious Office add-in execution and tune the rules for your specific environment.
• Block execution of Office add-ins from common temporary directories like %TEMP% and Downloads using application control policies. This mitigates the risk highlighted in the "Attack Chain" section.
• Regularly review and audit installed Office add-ins to identify and remove any unauthorized or suspicious add-ins.
• Monitor process execution for unusual parent-child relationships involving Office applications, as highlighted in the Sigma rules and the attack chain.