Sigma rule: Potential Persistence Via Visual Studio Tools for Office

Rule

Title

Potential Persistence Via Visual Studio Tools for Office

Status

test

Level

medium

Author

Bhabesh Raj

Date

2021-01-10

Modified

2026-01-09

File

rules/windows/registry/registry_set/registry_set_persistence_office_vsto.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|contains:
        - '\Software\Microsoft\Office\Outlook\Addins\'
        - '\Software\Microsoft\Office\Word\Addins\'
        - '\Software\Microsoft\Office\Excel\Addins\'
        - '\Software\Microsoft\Office\Powerpoint\Addins\'
        - '\Software\Microsoft\VSTO\Security\Inclusion\'
filter_main_system:
    Image:
        - 'C:\Windows\System32\msiexec.exe'
        - 'C:\Windows\SysWOW64\msiexec.exe'
        - 'C:\Windows\System32\regsvr32.exe'
        - 'C:\Windows\SysWOW64\regsvr32.exe' # e.g. default Evernote installation
filter_main_office_click_to_run:
    Image|startswith:
        - 'C:\Program Files\Common Files (x86)\Microsoft Shared\ClickToRun\'
        - 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'
    Image|endswith: '\OfficeClickToRun.exe'
filter_main_integrator:
    Image:
        - 'C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe'
        - 'C:\Program Files\Microsoft Office\root\integration\integrator.exe'
filter_main_office_apps:
    Image|startswith:
        - 'C:\Program Files\Microsoft Office\OFFICE'
        - 'C:\Program Files (x86)\Microsoft Office\OFFICE'
        - 'C:\Program Files\Microsoft Office\Root\OFFICE'
        - 'C:\Program Files (x86)\Microsoft Office\Root\OFFICE'
        - 'C:\PROGRA~2\MICROS~2\Office'
    Image|endswith:
        - '\excel.exe'
        - '\Integrator.exe'
        - '\OneNote.exe'
        - '\outlook.exe'
        - '\powerpnt.exe'
        - '\Teams.exe'
        - '\visio.exe'
        - '\winword.exe'
filter_main_vsto:
    Image|startswith:
        - 'C:\Program Files\Common Files\Microsoft Shared\VSTO\'
        - 'C:\Program Files (x86)\Microsoft Shared\VSTO\'
    Image|endswith: '\VSTOInstaller.exe'
filter_optional_avg:
    Image:
        - 'C:\Program Files\AVG\Antivirus\RegSvr.exe'
        - 'C:\Program Files (x86)\AVG\Antivirus\RegSvr.exe'
    TargetObject|contains: '\Microsoft\Office\Outlook\Addins\Antivirus.AsOutExt\'
filter_optional_avast:
    Image:
        - 'C:\Program Files\Avast Software\Avast\RegSvr.exe'
        - 'C:\Program Files (x86)\Avast Software\Avast\RegSvr.exe'
    TargetObject|contains: '\Microsoft\Office\Outlook\Addins\Avast.AsOutExt\'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Legitimate Addin Installation

Tags

• attack.t1137.006
• attack.persistence

MITRE ATT&CK ids this rule names

• T1137.006

References

• https://twitter.com/_vivami/status/1347925307643355138
• https://vanmieghem.io/stealth-outlook-persistence/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_persistence_office_vsto.yml