Potential Persistence Via Microsoft Office Startup Folder
This rule detects the creation of Microsoft Office files (Word documents, Excel spreadsheets) within the default startup folders for Microsoft Word and Excel. This technique can be used by adversaries to establish persistence, as these files will automatically execute or load when the respective Office application is launched. The rule specifically looks for file creations in paths containing '\Microsoft\Word\STARTUP' or '\Microsoft\Excel\XLSTART', and also considers paths containing both '\Office' and '\Program Files' along with '\STARTUP' or '\XLSTART'. It filters out legitimate creations by the Office applications themselves (WINWORD.exe, EXCEL.exe) to reduce false positives.
Sigma
