Elastic Defend high stable eql

Microsoft Office AddIn Loaded

Detects attempts to load an unsigned executable from known Microsoft Office add-ins directories. Adversaries may leverage Office Addins for persistence.

View Source

Detection Logic

library where
  process.name : ("winword.exe", "excel.exe") and
  (dll.code_signature.trusted == false or dll.code_signature.exists == false) and
  not dll.code_signature.status : ("errorExpired", "errorCode_endpoint*") and dll.hash.sha256 != null and
  dll.path :
    ("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Word\\Startup\\*",
     "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\AddIns\\*",
     "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*") and

  /* mainly https://github.com/Excel-DNA/ExcelDna */
  not dll.hash.sha256 :
               ("77fbc709353e2fc68091ef4eaf92d9926b1f36201e1cb5c59583867c6b8979e2",
                "20a33e2b3bf3da40a44b2001b60fbdac5e047154a169d77170b2ef7b0f5ae75a",
                "cb9b45da021609e16290e8abed62a6bc3c5ac588316bab40b091f64ea137e7df",
                "cb9b45da021609e16290e8abed62a6bc3c5ac588316bab40b091f64ea137e7df",
                "20a33e2b3bf3da40a44b2001b60fbdac5e047154a169d77170b2ef7b0f5ae75a",
                "b89a91c4cacda40c8ecafc9d9accd42d75a9158457273f12b1dbd0d1962becf3",
                "a5b7f6173251349613213e8ee0517e7677c03367b213d70d62f0f251283c3253",
                "582098e0e01d7beddd8f63333569aac96e06bfcef2d1ce61a9fddd99f651caf1",
                "b0a8ca7e555f53536e4f570ba3c8bf34274745bb63e70539fb080a1010dba053",
                "6e5fab5ccee725eb32144e36e1f0486f892ed99ad85e8d6a0354ced2eeed3759",
                "582098e0e01d7beddd8f63333569aac96e06bfcef2d1ce61a9fddd99f651caf1",
                "b0a8ca7e555f53536e4f570ba3c8bf34274745bb63e70539fb080a1010dba053",
                "6e5fab5ccee725eb32144e36e1f0486f892ed99ad85e8d6a0354ced2eeed3759",
                "e6ae5ef0a7b1d1a0276be13de9df13c2effbb8c70df45379a24882188d681b51",
                "83fd2689932d14a23f17de26ddc201f5a9f69060f550992feb421396c6914b06",
                "ff0c659513d58f670e1518fd529ba77dc2b051599dd74d88392a6c0a94414ee2")

Field Validations

Loading…

Comments (0)

Loading comments...