PowerShell Script Registers Office XLL Add-in
This rule detects PowerShell script blocks that attempt to register an XLL (Excel Add-in) file using COM objects. Adversaries may abuse Microsoft Office add-ins, specifically XLL files, to establish persistence on a compromised system. The detection looks for the combination of 'new-object', '-ComObject', '.application', and '.RegisterXLL' within a PowerShell script block, indicating an attempt to programmatically register an XLL add-in.
Sigma
