Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
26 detections
Filters
Last updated
All Time
Detection languages
15
9
1
1
Contributors
9
6
6
2
1
Categories
9
5
4
3
3
Platforms
18
6
2
1
1
Products / Services
5
4
3
3
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
IDS Classtypes
1
IDS Protocols
1
Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system.
Office add-ins can be used to add functionality to Office programs
Office add-ins can be used to add functionality to Office programs
Detects installation of malicious Office add-ins for persistent macro execution
This rule detects the delivery of potentially malicious Office add-in files (VSTO, XLA, XLAM) or COM files over HTTP. It specifically looks for these file extensions in the HTTP URI and verifies that the file content starts with 'MZ', indicating a Windows executable or DLL.
Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.
In this campaign, the threat actor leveraged specially crafted Microsoft RTF files to exploit CVE-2026-21509 and deliver malicious backdoors in a multi-stage infection chain. Due to significant overlaps in tools, techniques, and procedures (TTPs) between this campaign and those of the Russia-linked advanced persistent threat (APT) group APT28, we attribute this new campaign to APT28 with high confidence. Microsoft released an out-of-band update to address CVE-2026-21509 on January 26, 2026. ThreatLabz observed active in-the-wild exploitation on January 29, 2026.
Detects Microsoft Excel spawning an executable in a typical malware staging directory directory. This behavior is a strong indicator of a malicious XLL loader used by the Paper Werewolf (GOFFEE) group to drop the EchoGather backdoor.
Detects potential persistence established through the modification of registry keys related to Visual Studio Tools for Office (VSTO) add-ins for Microsoft Office applications like Outlook, Word, Excel, and PowerPoint. Adversaries can leverage VSTO add-ins to execute malicious code when an Office application starts, thereby maintaining persistence on a compromised system. The rule specifically looks for changes to the 'Addins' registry paths for various Office applications and the VSTO Security Inclusion path, while filtering out common legitimate processes that might make such changes.
KQL Query
Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.
Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.
Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system.
Office add-ins can be used to add functionality to Office programs
Office add-ins can be used to add functionality to Office programs
Detect potential persistence via the creation of an excel add-in (XLL) file to make it run automatically when Excel is started.
Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel).
'Identifies accounts that have been added to a PIM managed privileged group'
This query will find when a new credential is added to an application or service principal.
The Nobelium activity group was able to gain sufficient access to add credentials to existing applications with mail read permissions. They used that access to exfiltrate email.
See Customer Guidance on Recent Nation-State Cyber Attacks for more on the Nobelium campaign (formerly known as Solorigate).
Additional information on OAuth Credential Grants can be found in RFC 6749 Section 4.4 or Microsoft Entra ID audit activity reference.
For further information on AuditLogs please see Microsoft Entra ID audit activity reference.
This query was inspired by an Azure Sentinel detection.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://docs.microsoft.com/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow
https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/NewAppOrServicePrincipalCredential.yaml
The Nobelium activity group was able to gain sufficient access to add credentials to existing applications with mail read permissions. They used that access to exfiltrate email.
See Customer Guidance on Recent Nation-State Cyber Attacks for more on the Nobelium campaign (formerly known as Solorigate).
Additional information on OAuth Credential Grants can be found in RFC 6749 Section 4.4 or Microsoft Entra ID audit activity reference.
For further information on AuditLogs please see Microsoft Entra ID audit activity reference.
This query was inspired by an Azure Sentinel detection.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://docs.microsoft.com/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow
https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/NewAppOrServicePrincipalCredential.yaml
Detect potential persistence via the creation of an excel add-in (XLL) file to make it run automatically when Excel is started.
'This query looks for accounts being created that do not have attributes populated that are commonly populated in the tenant.
Attackers may attempt to add accounts as a means of establishing persistant access to an environment, looking for anomalies in created accounts may help identify illegitimately created accounts.
Created accounts should be investigated to ensure they were legitimated created.
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#accounts-not-following-naming-policies'
Attackers may attempt to add accounts as a means of establishing persistant access to an environment, looking for anomalies in created accounts may help identify illegitimately created accounts.
Created accounts should be investigated to ensure they were legitimated created.
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#accounts-not-following-naming-policies'
Prior to deploying Macaw ransomware in an organization, the adversary will disable several tools and functions in order to inhibit later recovery efforts.
Added credential from country X and Signed-In from country Y in a pecific time window:
This query tries to find all applications that credentials were added to them from country X while the application's identity Signed-In from country Y in a specific time window.
This query tries to find all applications that credentials were added to them from country X while the application's identity Signed-In from country Y in a specific time window.
'This query looks at the last 14 days for "Consent to application" operation by a user/app which could potentially mean unauthorized access. Additional context is added from AuditLogs based on CorrleationId from the same account that performed the action.'
This rule detects the creation of files with uncommon extensions within Microsoft Office application startup folders, specifically for Word and Excel. Adversaries often leverage these folders to establish persistence by placing malicious documents, templates, or add-ins that execute automatically when the respective Office application is launched. The rule filters out common and legitimate Office file extensions to reduce false positives.
Page 1 of 2