NaikonG0019 ↗
Has used the RoyalRoad exploit builder to drop a second stage loader, intel.wll, into the Word Startup folder on the compromised host.1
- Tactic
- Persistence
- Platforms
- Windows, Office Suite
- Version
- 1.2
- Created
- 07 November 2019
- Last modified
- 24 October 2025
Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs. [1] There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins. [2][3]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.3
Tools & malware57th pct
Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.4
Detection rules60th pct
Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.Add-ins MITRE reference T1137.006
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
LunarLoaderS1143 ↗
Has the ability to use Microsoft Outlook add-ins to establish persistence. 1
LunarMailS1142 ↗
Has the ability to use Outlook add-ins for persistence.1
BisonalS0268 ↗
Has been loaded through a .wll extension added to the %APPDATA%\microsoft\word\startup\ repository.1
All 3 software entries for this technique
Offense vs defense T1137.006
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 0
first rule: 2020 Q2Add-ins detection strategy DET0050
MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Persistence via Malicious Office Add-ins
2 platforms
AN0137 · Windows
An adversary writes or drops a malicious Office Add-in (e.g., WLL, XLL, COM) to a trusted directory or modifies registry keys to load malicious add-ins on Office application launch. Upon user opening Word or Excel, the add-in is automatically loaded, triggering execution of the payload, often spawning scripting engines or anomalous child processes.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| File ModificationDC0061 | WinEventLog:Sysmon | EventCode=2 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Sysmon | EventCode=13, 14 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AddInExtension | Malicious add-ins may have varying extensions (.wll, .xll, .dll, .vsto) |
| TrustedPath | Office trusted add-in paths may differ across enterprise configurations |
| RegistryPath | Registry keys used to load add-ins may be version- and app-specific |
| ChildProcessName | Office processes spawning mshta.exe, powershell.exe, or rundll32.exe are abnormal |
| TimeWindow | Add-in loading may occur only during Office launch windows |
AN0138 · Office Suite
Malicious Office add-ins loaded via VSTO, COM, or VBA auto-load paths. Upon launch of Word/Excel/Outlook, the add-in executes code without user action. Add-in resides in trusted directory or registered via Office COM/VBE subsystem. Behavior includes unsigned add-in execution, anomalous load context, or add-in spawning interpreter process.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | WinEventLog:Application | Office Add-in load errors, abnormal loading context, or unsigned add-in warnings |
| Command ExecutionDC0064 | WinEventLog:Microsoft-Office/OutlookAddinMonitor | Outlook loading add-in via unexpected load path or non-default profile context |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UnsignedAddInBehavior | Admins may allow or block unsigned add-ins depending on GPO configuration |
| OfficeProductVersion | Different Office versions store trusted paths and add-in configs in version-specific locations |
| AddInTrigger | Some add-ins only load on specific actions (new document, open file, etc.) |
On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Office applications from creating child processes and from writing potentially malicious executable content to disk.
Tests5ExecutorsPowerShell 5Need elevation0 of 5Have prerequisites5Have cleanup5Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition