{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/office-add-in/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["persistence","office-add-in","powershell","windows","threat-detection"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eAdversaries abuse the Microsoft Office Add-in architecture to establish persistence on compromised systems. By utilizing the COM interface, specifically the RegisterXLL method, attackers can load arbitrary dynamic link libraries (DLLs) disguised as Office add-ins into the memory space of Office applications. This technique is often executed via PowerShell scripts, allowing for stealthy code execution that persists across sessions or is triggered upon the initiation of Office processes. This method is documented in the Atomic Red Team framework under T1137.006, highlighting its utility for maintaining a foothold in environments where Office applications are regularly used. Detection relies on monitoring PowerShell script block activity for specific COM object instantiation and method invocation, necessitating that Script Block Logging (Event ID 4104) is enabled across the endpoint environment.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains initial code execution on a target endpoint via phishing or secondary exploit.\u003c/li\u003e\n\u003cli\u003eAttacker writes a malicious DLL (XLL) file to a local directory.\u003c/li\u003e\n\u003cli\u003eAttacker executes a PowerShell script to interact with the Office COM interface.\u003c/li\u003e\n\u003cli\u003eThe script initializes an Office application (e.g., Excel) via \u003ccode\u003eNew-Object -ComObject\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe PowerShell script invokes the \u003ccode\u003e.RegisterXLL\u003c/code\u003e method on the initialized application object.\u003c/li\u003e\n\u003cli\u003eThe Office application loads the malicious XLL file from the specified path.\u003c/li\u003e\n\u003cli\u003eThe code within the XLL executes within the context of the Office process.\u003c/li\u003e\n\u003cli\u003eMalicious code establishes long-term persistence or communicates with an attacker-controlled C2 server.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for stealthy, process-resident persistence within Microsoft Office, enabling attackers to execute arbitrary code, perform credential harvesting, or exfiltrate sensitive data whenever the user interacts with the compromised Office application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eEnable PowerShell Script Block Logging (Event ID 4104) on all Windows endpoints to ensure the execution of RegisterXLL commands is captured.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect the specific COM object registration pattern in PowerShell logs.\u003c/li\u003e\n\u003cli\u003eImplement endpoint controls to restrict the loading of unsigned or non-standard add-ins in Office applications.\u003c/li\u003e\n\u003cli\u003eMonitor for unauthorized or suspicious DLL creation and modification in Office-related directories.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-03T13:41:05Z","date_published":"2026-09-03T13:41:05Z","id":"https://feed.craftedsignal.io/briefs/2026-09-office-xll-persistence/","summary":"Adversaries leverage the RegisterXLL COM method via PowerShell to execute malicious add-ins and achieve persistence within Microsoft Office environments.","title":"Abuse of Microsoft Office Add-in XLL Files for Persistence","url":"https://feed.craftedsignal.io/briefs/2026-09-office-xll-persistence/"}],"language":"en","title":"CraftedSignal Threat Feed - Office-Add-In","version":"https://jsonfeed.org/version/1.1"}