Microsoft Word Add-In (.wll) File Loaded
Detects Microsoft Word loading an Add-In (.wll) file, which can be used by threat actors for initial access or persistence. This rule specifically looks for the 'ImageLoaded' event where the loaded file has a '.wll' extension and the 'Image' (process) is 'winword.exe'.
Sigma
