Skip to content
Threat Feed
Subscribe
high advisory

Persistence via Excel Add-in Registry Modification

Attackers achieve persistence by registering malicious XLL add-ins in the Windows registry, causing them to load automatically when Excel is launched.

Persistence mechanisms targeting Microsoft Office applications are a common vector for maintaining access to compromised endpoints. One such technique involves the use of XLL files, which are Excel add-ins based on the Excel XLL Software Development Kit. By modifying specific registry keys associated with Excel options, an attacker can configure the application to load a malicious XLL file whenever Excel starts. This technique effectively hides the malicious component within the context of a trusted office application and ensures it executes every time the user interacts with the suite. Defenders should monitor registry modifications targeting the Excel options path to identify unauthorized add-in configurations.

Impact

Successful exploitation allows for persistent, background execution of arbitrary code within the user's security context whenever Excel is initialized. This enables attackers to maintain long-term access, exfiltrate data, or deploy secondary payloads while remaining difficult to detect via traditional process-based monitoring.

Recommendation

Deploy the provided Sigma rule to monitor registry modifications within Excel options. Audit existing Excel add-ins for unknown or unsigned XLL files in registry keys and startup directories.

Tags

  • persistence
  • windows
  • office

Immediate actions

Deploy registry monitoring for Excel options subkeys.

Detection Engineering 48h

Threat Hunt

Search for existing registry keys containing /R and .xll in Office Options hives.

T1137.006 medium high confidence hunt now

Data: Endpoint registry dumps

Detection coverage 1

Detect Persistence via Excel Add-in Registry

high

Detects the creation of an Excel add-in (XLL) registry entry that forces the file to load automatically when Excel starts.

sigma tactics: persistence techniques: T1137.006 sources: registry_set, windows

Detection queries are available on the platform. Get full rules →