Skip to content
Threat Feed
Subscribe

Tag

Office-Addins

2 briefs RSS
high advisory

Persistence via Malicious Microsoft Office Add-ins

Attackers can establish persistence by placing malicious add-ins (e.g., .xll, .xlam) in Microsoft Office startup directories, ensuring execution each time the application launches.

Microsoft Office +2 persistence office-addins windows
2r 1t
medium advisory

Suspicious Execution via Microsoft Office Add-Ins

This rule identifies suspicious execution patterns where Microsoft Office applications launch add-ins from unusual paths or with atypical parent processes, potentially indicating initial access via a malicious phishing MS Office Add-In.

Microsoft Word +3 office-addins initial-access phishing
3r 4t