Query: detect Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications. in logs
Matching passage: Sigma rule: Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Visual Studio Tools for Office id: 9d15044a-7cfe-4d23-8085-6ebc11df7685 status: test description: Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications. references: - https://twitter.com/_vivami/status/1347925307643355138 - https://vanmieghem.io/stealth-outlook-persistence/ author: Bhabesh Raj date: 2021-01-10 modified: 2026-01-09 tags: - attack.t1137.006 - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Software\Microsoft\Office\Outlook\Addins\ - \Software\Microsoft\Office\Word\Addins\ - \Software\Microsoft\Office\Excel\Addins\ - \Software\Microsoft\Office\Powerpoint\Addins\ - \Software\Microsoft\VSTO\Security\Inclusion\ filter_main_system: Image: - C:\Windows\System32\msiexec.exe - C:\Windows\SysWOW64\msiexec.exe - C:\Windows\System32\regsvr32.exe - C:\Windows\SysWOW64\regsvr32.exe filter_main_office_click_to_run: Image|startswith: - C:\Program Files\Common Files (x86)\Microsoft Shared\ClickToRun\ - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ Image|endswith: \OfficeClickToRun.exe filter_main_integrator: Image: - C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe - C:\Program Files\Microsoft Office\root\integration\integrator.exe filter_main_office_apps: Image|startswith: - C:\Program Files\Microsoft Office\OFFICE - C:\Program Files (x86)\Microsoft Office\OFFICE - C:\Program Files\Microsoft Office\Root\OFFICE - C:\Program Files (x86)\Microsoft Office\Root\OFFICE - C:\PROGRA~2\MICROS~2\Office Image|endswith: - \excel.exe - \Integrator.exe - \OneNote.exe - \outlook.exe - \powerpnt.exe - \Teams.exe - \visio.exe - \winword.exe filter_main_vsto: Image|startswith: - C:\Program Files\Common Files\Microsoft Shared\VSTO\ - C:\Program Files (x86)\Microsoft Shared\VSTO\ Image|endswith: \VSTOInstaller.exe filter_optional_avg: Image: - C:\Program Files\AVG\Antivirus\RegSvr.exe - C:\Program Files (x86)\AVG\Antivirus\RegSvr.exe TargetObject|contains: \Microsoft\Office\Outlook\Addins\Antivirus.AsOutExt\ filter_optional_avast: Image: - C:\Program Files\Avast Software\Avast\RegSvr.exe - C:\Program Files (x86)\Avast Software\Avast\RegSvr.exe TargetObject|contains: \Microsoft\Office\Outlook\Addins\Avast.AsOutExt\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate Addin Installation level: medium
Near-miss passage: Sigma rule: Detects potential abuse of ntdsutil to dump ntds.dit database to a suspicious location. Logsource: windows / application. Rule: title: Dump Ntds.dit To Suspicious Location id: 94dc4390-6b7c-4784-8ffc-335334404650 status: test description: Detects potential abuse of ntdsutil to dump ntds.dit database to a suspicious location references: - https://twitter.com/mgreen27/status/1558223256704122882 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj574207(v=ws.11) author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-14 modified: 2023-10-23 tags: - attack.execution logsource: product: windows service: application detection: selection_root: Provider_Name: ESENT EventID: 325 Data|contains: ntds.dit selection_paths: Data|contains: - :\ntds.dit - \Appdata\ - \Desktop\ - \Downloads\ - \Perflogs\ - \Temp\ - \Users\Public\ condition: all of selection_* falsepositives: - Legitimate backup operation/creating shadow copies level: medium