Query: write Sigma for Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.
Matching passage: Sigma rule: Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Visual Studio Tools for Office id: 9d15044a-7cfe-4d23-8085-6ebc11df7685 status: test description: Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications. references: - https://twitter.com/_vivami/status/1347925307643355138 - https://vanmieghem.io/stealth-outlook-persistence/ author: Bhabesh Raj date: 2021-01-10 modified: 2026-01-09 tags: - attack.t1137.006 - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Software\Microsoft\Office\Outlook\Addins\ - \Software\Microsoft\Office\Word\Addins\ - \Software\Microsoft\Office\Excel\Addins\ - \Software\Microsoft\Office\Powerpoint\Addins\ - \Software\Microsoft\VSTO\Security\Inclusion\ filter_main_system: Image: - C:\Windows\System32\msiexec.exe - C:\Windows\SysWOW64\msiexec.exe - C:\Windows\System32\regsvr32.exe - C:\Windows\SysWOW64\regsvr32.exe filter_main_office_click_to_run: Image|startswith: - C:\Program Files\Common Files (x86)\Microsoft Shared\ClickToRun\ - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ Image|endswith: \OfficeClickToRun.exe filter_main_integrator: Image: - C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe - C:\Program Files\Microsoft Office\root\integration\integrator.exe filter_main_office_apps: Image|startswith: - C:\Program Files\Microsoft Office\OFFICE - C:\Program Files (x86)\Microsoft Office\OFFICE - C:\Program Files\Microsoft Office\Root\OFFICE - C:\Program Files (x86)\Microsoft Office\Root\OFFICE - C:\PROGRA~2\MICROS~2\Office Image|endswith: - \excel.exe - \Integrator.exe - \OneNote.exe - \outlook.exe - \powerpnt.exe - \Teams.exe - \visio.exe - \winword.exe filter_main_vsto: Image|startswith: - C:\Program Files\Common Files\Microsoft Shared\VSTO\ - C:\Program Files (x86)\Microsoft Shared\VSTO\ Image|endswith: \VSTOInstaller.exe filter_optional_avg: Image: - C:\Program Files\AVG\Antivirus\RegSvr.exe - C:\Program Files (x86)\AVG\Antivirus\RegSvr.exe TargetObject|contains: \Microsoft\Office\Outlook\Addins\Antivirus.AsOutExt\ filter_optional_avast: Image: - C:\Program Files\Avast Software\Avast\RegSvr.exe - C:\Program Files (x86)\Avast Software\Avast\RegSvr.exe TargetObject|contains: \Microsoft\Office\Outlook\Addins\Avast.AsOutExt\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate Addin Installation level: medium
Near-miss passage: Sigma rule: This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded. Logsource: windows / system. Rule: title: DHCP Server Loaded the CallOut DLL id: 13fc89a9-971e-4ca6-b9dc-aa53a445bf40 status: test description: This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded references: - https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html - https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx - https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx author: Dimitrios Slamaris date: 2017-05-15 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows service: system detection: selection: EventID: 1033 Provider_Name: Microsoft-Windows-DHCP-Server condition: selection falsepositives: - Unknown level: high