Sigma rule: Potential Persistence Via Microsoft Office Startup Folder

Rule

Title

Potential Persistence Via Microsoft Office Startup Folder

Status

test

Level

high

Author

Max Altgelt (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Date

2022-06-02

Modified

2023-06-22

File

rules/windows/file/file_event/file_event_win_office_startup_persistence.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.

Log source

product

windows

category

file_event

Detection

selection_word_paths:
    - TargetFilename|contains: '\Microsoft\Word\STARTUP'
    - TargetFilename|contains|all:
          - '\Office'
          - '\Program Files'
          - '\STARTUP'
selection_word_extension:
    TargetFilename|endswith:
        - '.doc'
        - '.docm'
        - '.docx'
        - '.dot'
        - '.dotm'
        - '.rtf'
selection_excel_paths:
    - TargetFilename|contains: '\Microsoft\Excel\XLSTART'
    - TargetFilename|contains|all:
          - '\Office'
          - '\Program Files'
          - '\XLSTART'
selection_excel_extension:
    TargetFilename|endswith:
        - '.xls'
        - '.xlsm'
        - '.xlsx'
        - '.xlt'
        - '.xltm'
filter_main_office:
    Image|endswith:
        - '\WINWORD.exe'
        - '\EXCEL.exe'
condition: (all of selection_word_* or all of selection_excel_*) and not filter_main_office

False positives (as the rule lists them)

• Loading a user environment from a backup or a domain controller
• Synchronization of templates

Tags

• attack.persistence
• attack.t1137

MITRE ATT&CK ids this rule names

• T1137

References

• https://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanese-companies
• https://learn.microsoft.com/en-us/office/troubleshoot/excel/use-startup-folders

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_office_startup_persistence.yml