t1137-006-add-ins

name	T1137.006_add-ins
description	Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1137.006","persistence","windows","office-suite","sub-technique"]
technique_id	T1137.006
tactic	persistence
all_tactics	["persistence"]
platforms	["Windows","Office Suite"]
mitre_url	https://attack.mitre.org/techniques/T1137/006
tech_stack	["windows","office"]
cwe_ids	["CWE-276"]
chains_with	["T1137","T1137.001","T1137.002","T1137.003","T1137.004","T1137.005"]
prerequisites	["T1137"]
severity_boost	{"T1137":"Chain with T1137 for deeper attack path","T1137.001":"Chain with T1137.001 for deeper attack path","T1137.002":"Chain with T1137.002 for deeper attack path"}

T1137.006 Add-ins

Sub-technique of: T1137

High-Level Description

Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs. There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins.

Add-ins can be used to obtain persistence because they can be set to execute code when an Office application starts.

Kill Chain Phase

• Persistence (TA0003)

Platforms: Windows, Office Suite

What to Check

• Identify if Add-ins technique is applicable to target environment
• Check Windows systems for indicators of Add-ins
• Check Office Suite systems for indicators of Add-ins
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Code Executed Via Excel Add-in File (XLL)

Loads an XLL file using the excel add-ins library. This causes excel to launch Notepad.exe as a child process. This atomic test does not include persistent code execution as you would typically see when this is implemented in malware.

Supported Platforms: windows

$excelApp = New-Object -COMObject "Excel.Application"
if(-not $excelApp.path.contains("Program Files (x86)")){
    Write-Host "64-bit Office"
    $excelApp.RegisterXLL("PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll")
}
else{
  Write-Host "32-bit Office"
  $excelApp.RegisterXLL("PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll")
}

Dependencies:

• Microsoft Excel must be installed
• XLL files must exist on disk at specified location

Atomic Test 2: Persistent Code Execution Via Excel Add-in File (XLL)

Creates an Excel Add-in file (XLL) and sets a registry key to make it run automatically when Excel is started The sample XLL provided launches the notepad as a proof-of-concept for persistent execution from Office.