Potential Persistence Via Visual Studio Tools for Office Add-ins
Detects potential persistence established through the modification of registry keys related to Visual Studio Tools for Office (VSTO) add-ins for Microsoft Office applications like Outlook, Word, Excel, and PowerPoint. Adversaries can leverage VSTO add-ins to execute malicious code when an Office application starts, thereby maintaining persistence on a compromised system. The rule specifically looks for changes to the 'Addins' registry paths for various Office applications and the VSTO Security Inclusion path, while filtering out common legitimate processes that might make such changes.
Sigma
