Malicious Office Add-in VSTO Package Delivered

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects the delivery of potentially malicious Office add-in files (VSTO, XLA, XLAM) or COM files over HTTP. It specifically looks for these file extensions in the HTTP URI and verifies that the file content starts with 'MZ', indicating a Windows executable or DLL.