Sigma rule: Office Autorun Keys Modification

Rule

Title

Office Autorun Keys Modification

Status

test

Level

medium

Author

Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)

Date

2019-10-25

Modified

2026-08-28

File

rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_office.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects modification of autostart extensibility point (ASEP) in registry. Adversaries may modify these keys to execute malicious code when Office files are opened.
There are various legitimate add-ins that also use these keys and this filter list might not be exhaustive.
Thus, it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.

Log source

product

windows

category

registry_set

Detection

selection_office_root:
    TargetObject|contains:
        - '\Software\Wow6432Node\Microsoft\Office'
        - '\Software\Microsoft\Office'
selection_office_details:
    TargetObject|contains:
        - '\Word\Addins'
        - '\PowerPoint\Addins'
        - '\Outlook\Addins'
        - '\Onenote\Addins'
        - '\Excel\Addins'
        - '\Access\Addins'
        - 'test\Special\Perf'
filter_main_empty:
    Details: '(Empty)'
filter_main_null:
    Details: null
filter_main_known_addins:
    Image|startswith:
        - 'C:\Program Files\Microsoft Office\'
        - 'C:\Program Files (x86)\Microsoft Office\'
        - 'C:\PROGRA~2\MICROS~2\Office'
        - 'C:\Windows\System32\msiexec.exe'
        - 'C:\Windows\SysWOW64\msiexec.exe'
        - 'C:\Windows\System32\regsvr32.exe'
        - 'C:\Windows\SysWOW64\regsvr32.exe'
    TargetObject|contains:
        # Remove any unused addins in your environment from the filter
        # Known addins for excel
        - '\Excel\Addins\AdHocReportingExcelClientLib.AdHocReportingExcelClientAddIn.1\'
        - '\Excel\Addins\ExcelPlugInShell.PowerMapConnect\'
        - '\Excel\Addins\NativeShim\'
        - '\Excel\Addins\NativeShim.InquireConnector.1\'
        - '\Excel\Addins\PowerPivotExcelClientAddIn.NativeEntry.1\'
        # Known addins for outlook
        - '\Outlook\AddIns\AccessAddin.DC\'
        - '\Outlook\AddIns\ColleagueImport.ColleagueImportAddin\'
        - '\Outlook\AddIns\EvernoteCC.EvernoteContactConnector\'
        - '\Outlook\AddIns\EvernoteOLRD.Connect\'
        # - '\Outlook\Addins\GrammarlyAddIn.Connect' # Uncomment if you use Grammarly
        - '\Outlook\Addins\OneNote.OutlookAddin'
        - '\Outlook\Addins\DriveFSExtensionLib.Connect\' # An Outlook Add-in to talk with Google Drive
        - '\Outlook\Addins\GoogleAppsSync.Connect\' # Google Apps Sync for Microsoft Outlook
        - '\Outlook\Addins\Microsoft.VbaAddinForOutlook.1\'
        - '\Outlook\Addins\OcOffice.OcForms\'
        - '\Outlook\Addins\OscAddin.Connect\'
        - '\Outlook\Addins\OutlookChangeNotifier.Connect\'
        - '\Outlook\Addins\UCAddin.LyncAddin.1'
        - '\Outlook\Addins\UCAddin.UCAddin.1'
        - '\Outlook\Addins\UmOutlookAddin.FormRegionAddin\'
        - 'AddinTakeNotesService\FriendlyName'
filter_main_officeclicktorun:
    Image|startswith:
        - 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'
        - 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\'
    Image|endswith: '\OfficeClickToRun.exe'
filter_main_vsto:
    Image|startswith:
        - 'C:\Program Files\Common Files\Microsoft Shared\VSTO\'
        - 'C:\Program Files (x86)\Microsoft Shared\VSTO\'
    Image|endswith: '\VSTOInstaller.exe'
filter_optional_avg:
    Image:
        - 'C:\Program Files\AVG\Antivirus\RegSvr.exe'
        - 'C:\Program Files\AVG\Antivirus\x86\RegSvr.exe'
    TargetObject|contains: '\Microsoft\Office\Outlook\Addins\Antivirus.AsOutExt\'
filter_optional_avast:
    Image:
        - 'C:\Program Files\Avast Software\Avast\RegSvr.exe'
        - 'C:\Program Files\Avast Software\Avast\x86\RegSvr.exe'
    TargetObject|contains: '\Microsoft\Office\Outlook\Addins\Avast.AsOutExt\'
# These filters are not exhaustive, filter can be expanded based on environment
condition: all of selection_office_* and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Legitimate software or add-in installations and administrative configurations
• Automatic registry modifications during legitimate software installations

Tags

• attack.privilege-escalation
• attack.persistence
• attack.t1547.001

MITRE ATT&CK ids this rule names

• T1547.001

Related rules

• 17f878b8-9968-4578-b814-c4217fc5768c (obsolete)

References

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
• https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
• https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_office.yml