Potential Persistence Via Excel Add-in Registry Modification
Detects potential persistence by monitoring for modifications to the Excel Options registry key, specifically looking for the addition of an Excel Add-in (XLL) file that would cause it to run automatically when Excel starts. This technique is often used by adversaries to maintain access to a compromised system.
Sigma
