Sigma rule: Microsoft Word Add-In Loaded

Rule

Title

Microsoft Word Add-In Loaded

Status

test

Level

low

Author

Steffen Rogge (dr0pd34d)

Date

2024-07-10

File

rules-threat-hunting/windows/image_load/image_load_office_word_wll_load.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects Microsoft Word loading an Add-In (.wll) file which can be used by threat actors for initial access or persistence.

Log source

product

windows

category

image_load

Detection

selection:
    Image|endswith: '\winword.exe'
    ImageLoaded|endswith: '.wll'
condition: selection

False positives (as the rule lists them)

• The rules is only looking for ".wll" loads. So some false positives are expected with legitimate and allowed WLLs.

Tags

• attack.execution
• attack.t1204.002
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1204.002

References

• https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence
• https://nored0x.github.io/red-teaming/office-persistence/#what-is-a-wll-file

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/image_load/image_load_office_word_wll_load.yml