Abuse of Microsoft Office Add-in XLL Files for Persistence

Adversaries abuse the Microsoft Office Add-in architecture to establish persistence on compromised systems. By utilizing the COM interface, specifically the RegisterXLL method, attackers can load arbitrary dynamic link libraries (DLLs) disguised as Office add-ins into the memory space of Office applications. This technique is often executed via PowerShell scripts, allowing for stealthy code execution that persists across sessions or is triggered upon the initiation of Office processes. This method is documented in the Atomic Red Team framework under T1137.006, highlighting its utility for maintaining a foothold in environments where Office applications are regularly used. Detection relies on monitoring PowerShell script block activity for specific COM object instantiation and method invocation, necessitating that Script Block Logging (Event ID 4104) is enabled across the endpoint environment.

Attack Chain

1. Attacker gains initial code execution on a target endpoint via phishing or secondary exploit.
2. Attacker writes a malicious DLL (XLL) file to a local directory.
3. Attacker executes a PowerShell script to interact with the Office COM interface.
4. The script initializes an Office application (e.g., Excel) via New-Object -ComObject.
5. The PowerShell script invokes the .RegisterXLL method on the initialized application object.
6. The Office application loads the malicious XLL file from the specified path.
7. The code within the XLL executes within the context of the Office process.
8. Malicious code establishes long-term persistence or communicates with an attacker-controlled C2 server.

Impact

Successful exploitation allows for stealthy, process-resident persistence within Microsoft Office, enabling attackers to execute arbitrary code, perform credential harvesting, or exfiltrate sensitive data whenever the user interacts with the compromised Office application.

Recommendation

1. Enable PowerShell Script Block Logging (Event ID 4104) on all Windows endpoints to ensure the execution of RegisterXLL commands is captured.
2. Deploy the provided Sigma rule to detect the specific COM object registration pattern in PowerShell logs.
3. Implement endpoint controls to restrict the loading of unsigned or non-standard add-ins in Office applications.
4. Monitor for unauthorized or suspicious DLL creation and modification in Office-related directories.