Elastic Defend high stable eql

Microsoft Office AddIn Creation

Detects attempts to create or modify a file in known Microsoft Office add-ins directories. Adversaries may leverage Microsoft Office Addins for persistence.

View Source

Detection Logic

file where event.action != "deletion" and

  file.Ext.header_bytes : "4d5a*" and

  file.path :
    ("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Word\\Startup\\*",
     "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\AddIns\\*",
     "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*") and

  not (process.executable : "?:\\Windows\\sys*\\msiexec.exe" and file.path : "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\AddIns\\*") and 
  not process.executable : "?:\\Windows\\explorer.exe" and 
  not (process.code_signature.subject_name : "Lars Schenk" and process.code_signature.trusted == true)

Field Validations

Loading…

Comments (0)

Loading comments...