Microsoft Excel Add-In (.xll) Loaded
Detects Microsoft Excel loading an Add-In (.xll) file. Adversaries may use malicious Excel Add-Ins to execute arbitrary code, establish persistence, or perform other malicious activities. This rule specifically looks for the loading of '.xll' files by 'excel.exe'.
Sigma
