T1137.006, Add-ins, is a persistence technique that abuses Office add-ins. It applies to Windows and Office Suite.
How attackers use it
Add-ins extend Office programs, and MITRE lists many kinds: Word and Excel add-in libraries (WLL and XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, the VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins and Outlook add-ins. They can be set to run code when an Office application starts, which is what makes them useful for persistence. The page lists Naikon and Bisonal among users of the technique.
How to detect it
MITRE's analytics describe an adversary dropping a malicious add-in in a trusted directory or changing registry keys so the add-in loads at launch. Opening Word or Excel then runs the payload, often spawning scripting engines or odd child processes. Signs include unsigned add-in execution, an unusual load context, and an add-in spawning an interpreter. The add-in may be registered through the Office COM or VBE subsystem.
Telemetry to collect: file creation in add-in folders (Sysmon event ID 11), registry changes for add-in registration (Sysmon event IDs 12 and 13), and Office processes starting children (Sysmon event ID 1).
How to reduce the risk
MITRE lists Attack Surface Reduction rules on Windows 10 to stop Office applications creating child processes and writing potentially malicious executable content to disk. The parent technique adds that you should disable add-ins where possible, and require signed add-ins where they are needed.
Quick check
Name two add-in types MITRE lists.
Any two of WLL or XLL libraries, VBA add-ins, COM add-ins, automation add-ins, VBE, VSTO add-ins, and Outlook add-ins.
Sources
- MITRE ATT&CK, T1137.006 Add-ins
- MITRE ATT&CK, T1137 Office Application Startup
