T1137.006 — Add-ins

Tactic: Persistence · Platforms: Windows, Office Suite

Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs. There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL),…

Sub-technique of Office Application Startup (T1137).

Sigma detection rules (2)

title: "T1137.006 Office Application Startup: Add-ins"
id: 82b89c1e-4987-4897-afaa-8767c0737506
description: 'Detects registry writes to an Office application''s Addins LoadBehavior value, indicating installation or enabling of a (potentially malicious) Office COM/VBA add-in for persistence. Tune using: AddInExtension, TrustedPath, RegistryPath, ChildProcessName, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1137/006
author: Shahrukh Khan
date: 2026-03-31
license: MIT
tags:
  - attack.persistence
  - attack.t1137.006

logsource:
  category: registry_set
  product: windows
  service: sysmon

detection:
  selection:
    TargetObject|contains: '\Addins\'
    TargetObject|endswith: '\LoadBehavior'

  condition: selection

falsepositives:
  - Legitimate installation of a signed, vetted Office add-in (e.g., corporate VSTO or COM add-in) by IT; verify the add-in's publisher/path against an allowlist.

level: medium

title: "T1137.006 Office Application Startup: Add-ins"
id: 1dc05732-b4ef-4a1a-a036-23d1c4b2b5eb
description: 'Detect Persistence via Malicious Office Add-ins. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: UnsignedAddInBehavior, OfficeProductVersion, AddInTrigger.'
references:
  - https://attack.mitre.org/techniques/T1137/006
author: Shahrukh Khan
date: 2026-01-07
license: MIT
tags:
  - attack.persistence
  - attack.t1137.006

logsource:
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 13
    TargetObject|contains:
      - '\Outlook\Addins\'
      - '\Excel\Addins\'
      - '\Word\Addins\'
  selection_loadbehavior:
    Details: '3'

  condition: selection and selection_loadbehavior

falsepositives:
  - IT-deployed legitimate Office add-ins (expense reporting, e-signature, CRM plugins) register the same LoadBehavior registry value during normal installation.

level: medium

Related sub-techniques

• T1137.003 Outlook Forms
• T1137.001 Office Template Macros
• T1137.002 Office Test
• T1137.004 Outlook Home Page
• T1137.005 Outlook Rules

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1137.006 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan