Potential Persistence Via Microsoft Office Add-In
This rule detects the creation or modification of specific file types (.wll, .xll, .xlam, .xla, .ppam) in Microsoft Office startup or add-in directories. These files can be used to establish persistence by executing malicious code when Microsoft Office applications (Word, Excel, PowerPoint) are launched. The rule specifically targets paths associated with Word Startup, Excel Startup, Excel XLSTART, and generic Microsoft Addins folders.
Sigma
