Office Autorun Keys Modification

Hunt Hypothesis

Detects modification of autostart extensibility point (ASEP) in registry. Adversaries may modify these keys to execute malicious code when Office files are opened. There are various legitimate add-ins

Detection Rule

Sigma (Original)

title: Office Autorun Keys Modification
id: baecf8fb-edbf-429f-9ade-31fc3f22b970
related:
    - id: 17f878b8-9968-4578-b814-c4217fc5768c
      type: obsolete
status: test
description: |
    Detects modification of autostart extensibility point (ASEP) in registry. Adversaries may modify these keys to execute malicious code when Office files are opened.
    There are various legitimate add-ins that also use these keys and this filter list might not be exhaustive.
    Thus, it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
    - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
    - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d # a list with registry keys
author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
date: 2019-10-25
modified: 2026-01-09
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1547.001
logsource:
    category: registry_set
    product: windows
detection:
    selection_office_root:
        TargetObject|contains:
            - '\Software\Wow6432Node\Microsoft\Office'
            - '\Software\Microsoft\Office'
    selection_office_details:
        TargetObject|contains:
            - '\Word\Addins'
            - '\PowerPoint\Addins'
            - '\Outlook\Addins'
            - '\Onenote\Addins'
            - '\Excel\Addins'
            - '\Access\Addins'
            - 'test\Special\Perf'
    filter_main_empty:
        Details: '(Empty)'
    filter_main_null:
        Details: null
    filter_main_known_addins:
        Image|startswith:
            - 'C:\Program Files\Microsoft Office\'
            - 'C:\Program Files (x86)\Microsoft Office\'
            - 'C:\PROGRA~2\MICROS~2\Office'
            - 'C:\Windows\System32\msiexec.exe'
            - 'C:\Windows\SysWOW64\msiexec.exe'
            - 'C:\Windows\System32\regsvr32.exe'
            - 'C:\Windows\SysWOW64\regsvr32.exe '
        TargetObject|contains:
            # Remove any unused addins in your environment from the filter
            # Known addins for excel
            - '\Excel\Addins\AdHocReportingExcelClientLib.AdHocReportingExcelClientAddIn.1\'
            - '\Excel\Addins\ExcelPlugInShell.PowerMapConnect\'
            - '\Excel\Addins\NativeShim\'
            - '\Excel\Addins\NativeShim.InquireConnector.1\'
            - '\Excel\Addins\PowerPivotExcelClientAddIn.NativeEntry.1\'
            # Known addins for outlook
            - '\Outlook\AddIns\AccessAddin.DC\'
            - '\Outlook\AddIns\ColleagueImport.ColleagueImportAddin\'
            - '\Outlook\AddIns\EvernoteCC.EvernoteContactConnector\'
            - '\Outlook\AddIns\EvernoteOLRD.Connect\'
            # - '\Outlook\Addins\GrammarlyAddIn.Connect' # Uncomment if you use Grammarly
            - '\Outlook\Addins\\OneNote.OutlookAddin'
            - '\Outlook\Addins\DriveFSExtensionLib.Connect\' # An Outlook Add-in to talk with Google Drive
            - '\Outlook\Addins\GoogleAppsSync.Connect\' # Google Apps Sync for Microsoft Outlook
            - '\Outlook\Addins\Microsoft.VbaAddinForOutlook.1\'
            - '\Outlook\Addins\OcOffice.OcForms\'
            - '\Outlook\Addins\OscAddin.Connect\'
            - '\Outlook\Addins\OutlookChangeNotifier.Connect\'
            - '\Outlook\Addins\UCAddin.LyncAddin.1'
            - '\Outlook\Addins\UCAddin.UCAddin.1'
            - '\Outlook\Addins\UmOutlookAddin.FormRegionAddin\'
            - 'AddinTakeNotesService\FriendlyName'
    filter_main_officeclicktorun:
        Image|startswith:
            - 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'
            - 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\'
        Image|endswith: '\OfficeClickToRun.exe'
    filter_main_vsto:
        Image|startswith:
            - 'C:\Program Files\Common Files\Microsoft Shared\VSTO\'
            - 'C:\Program Files (x86)\Microsoft Shared\VSTO\'
        Image|endswith: '\VSTOInstaller.exe'
    filter_optional_avg:
        Image:
            - 'C:\Program Files\AVG\Antivirus\RegSvr.exe'
            - 'C:\Program Files\AVG\Antivirus\x86\RegSvr.exe'
        TargetObject|contains: '\Microsoft\Office\Outlook\Addins\Antivirus.AsOutExt\'
    filter_optional_avast:
        Image:
            - 'C:\Program Files\Avast Software\Avast\RegSvr.exe'
            - 'C:\Program Files\Avast Software\Avast\x86\RegSvr.exe'
        TargetObject|contains: '\Microsoft\Office\Outlook\Addins\Avast.AsOutExt\'
    # These filters are not exhaustive, filter can be expanded based on environment
    condition: all of selection_office_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Legitimate software or add-in installations and administrative configurations
    - Automatic registry modifications during legitimate software installations
level: medium

KQL (Azure Sentinel)

imRegistry
| where ((RegistryKey contains "\\Software\\Wow6432Node\\Microsoft\\Office" or RegistryKey contains "\\Software\\Microsoft\\Office") and (RegistryKey contains "\\Word\\Addins" or RegistryKey contains "\\PowerPoint\\Addins" or RegistryKey contains "\\Outlook\\Addins" or RegistryKey contains "\\Onenote\\Addins" or RegistryKey contains "\\Excel\\Addins" or RegistryKey contains "\\Access\\Addins" or RegistryKey contains "test\\Special\\Perf")) and (not((RegistryValueData =~ "(Empty)" or isnull(RegistryValueData) or ((ActingProcessName startswith "C:\\Program Files\\Microsoft Office\\" or ActingProcessName startswith "C:\\Program Files (x86)\\Microsoft Office\\" or ActingProcessName startswith "C:\\PROGRA~2\\MICROS~2\\Office" or ActingProcessName startswith "C:\\Windows\\System32\\msiexec.exe" or ActingProcessName startswith "C:\\Windows\\SysWOW64\\msiexec.exe" or ActingProcessName startswith "C:\\Windows\\System32\\regsvr32.exe" or ActingProcessName startswith "C:\\Windows\\SysWOW64\\regsvr32.exe ") and (RegistryKey endswith "\\Excel\\Addins\\AdHocReportingExcelClientLib.AdHocReportingExcelClientAddIn.1*" or RegistryKey endswith "\\Excel\\Addins\\ExcelPlugInShell.PowerMapConnect*" or RegistryKey endswith "\\Excel\\Addins\\NativeShim*" or RegistryKey endswith "\\Excel\\Addins\\NativeShim.InquireConnector.1*" or RegistryKey endswith "\\Excel\\Addins\\PowerPivotExcelClientAddIn.NativeEntry.1*" or RegistryKey endswith "\\Outlook\\AddIns\\AccessAddin.DC*" or RegistryKey endswith "\\Outlook\\AddIns\\ColleagueImport.ColleagueImportAddin*" or RegistryKey endswith "\\Outlook\\AddIns\\EvernoteCC.EvernoteContactConnector*" or RegistryKey endswith "\\Outlook\\AddIns\\EvernoteOLRD.Connect*" or RegistryKey contains "\\Outlook\\Addins\\OneNote.OutlookAddin" or RegistryKey endswith "\\Outlook\\Addins\\DriveFSExtensionLib.Connect*" or RegistryKey endswith "\\Outlook\\Addins\\GoogleAppsSync.Connect*" or RegistryKey endswith "\\Outlook\\Addins\\Microsoft.VbaAddinForOutlook.1*" or RegistryKey endswith "\\Outlook\\Addins\\OcOffice.OcForms*" or RegistryKey endswith "\\Outlook\\Addins\\OscAddin.Connect*" or RegistryKey endswith "\\Outlook\\Addins\\OutlookChangeNotifier.Connect*" or RegistryKey contains "\\Outlook\\Addins\\UCAddin.LyncAddin.1" or RegistryKey contains "\\Outlook\\Addins\\UCAddin.UCAddin.1" or RegistryKey endswith "\\Outlook\\Addins\\UmOutlookAddin.FormRegionAddin*" or RegistryKey contains "AddinTakeNotesService\\FriendlyName")) or ((ActingProcessName startswith "C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\" or ActingProcessName startswith "C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\Updates\\") and ActingProcessName endswith "\\OfficeClickToRun.exe") or ((ActingProcessName startswith "C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" or ActingProcessName startswith "C:\\Program Files (x86)\\Microsoft Shared\\VSTO\\") and ActingProcessName endswith "\\VSTOInstaller.exe")))) and (not((((ActingProcessName in~ ("C:\\Program Files\\AVG\\Antivirus\\RegSvr.exe", "C:\\Program Files\\AVG\\Antivirus\\x86\\RegSvr.exe")) and RegistryKey endswith "\\Microsoft\\Office\\Outlook\\Addins\\Antivirus.AsOutExt*") or ((ActingProcessName in~ ("C:\\Program Files\\Avast Software\\Avast\\RegSvr.exe", "C:\\Program Files\\Avast Software\\Avast\\x86\\RegSvr.exe")) and RegistryKey endswith "\\Microsoft\\Office\\Outlook\\Addins\\Avast.AsOutExt*"))))

Required Data Sources

Sentinel Table	Notes
`imRegistry`	Ensure this data connector is enabled

Office Autorun Keys Modification

Hunt Hypothesis

Detection Rule

Sigma (Original)

KQL (Azure Sentinel)

Required Data Sources

False Positive Guidance

MITRE ATT&CK Context

References