Office Autorun Keys Modification
Detects modification of autostart extensibility point (ASEP) in registry.
Sigma rule (View on GitHub)
1title: Office Autorun Keys Modification
2id: baecf8fb-edbf-429f-9ade-31fc3f22b970
3related:
4 - id: 17f878b8-9968-4578-b814-c4217fc5768c
5 type: obsolete
6status: test
7description: Detects modification of autostart extensibility point (ASEP) in registry.
8references:
9 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
10 - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
11 - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d # a list with registry keys
12author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
13date: 2019-10-25
14modified: 2025-10-17
15tags:
16 - attack.privilege-escalation
17 - attack.persistence
18 - attack.t1547.001
19logsource:
20 category: registry_set
21 product: windows
22detection:
23 selection_office_root:
24 TargetObject|contains:
25 - '\Software\Wow6432Node\Microsoft\Office'
26 - '\Software\Microsoft\Office'
27 selection_office_details:
28 TargetObject|contains:
29 - '\Word\Addins'
30 - '\PowerPoint\Addins'
31 - '\Outlook\Addins'
32 - '\Onenote\Addins'
33 - '\Excel\Addins'
34 - '\Access\Addins'
35 - 'test\Special\Perf'
36 filter_main_empty:
37 Details: '(Empty)'
38 filter_main_known_addins:
39 Image|startswith:
40 - 'C:\Program Files\Microsoft Office\'
41 - 'C:\Program Files (x86)\Microsoft Office\'
42 - 'C:\Windows\System32\msiexec.exe'
43 - 'C:\Windows\System32\regsvr32.exe'
44 TargetObject|contains:
45 # Remove any unused addins in your environment from the filter
46 # Known addins for excel
47 - '\Excel\Addins\AdHocReportingExcelClientLib.AdHocReportingExcelClientAddIn.1\'
48 - '\Excel\Addins\ExcelPlugInShell.PowerMapConnect\'
49 - '\Excel\Addins\NativeShim\'
50 - '\Excel\Addins\NativeShim.InquireConnector.1\'
51 - '\Excel\Addins\PowerPivotExcelClientAddIn.NativeEntry.1\'
52 # Known addins for outlook
53 - '\Outlook\AddIns\AccessAddin.DC\'
54 - '\Outlook\AddIns\ColleagueImport.ColleagueImportAddin\'
55 - '\Outlook\AddIns\EvernoteCC.EvernoteContactConnector\'
56 - '\Outlook\AddIns\EvernoteOLRD.Connect\'
57 # - '\Outlook\Addins\GrammarlyAddIn.Connect' # Uncomment if you use Grammarly
58 - '\Outlook\Addins\Microsoft.VbaAddinForOutlook.1\'
59 - '\Outlook\Addins\OcOffice.OcForms\'
60 - '\Outlook\Addins\\OneNote.OutlookAddin'
61 - '\Outlook\Addins\OscAddin.Connect\'
62 - '\Outlook\Addins\OutlookChangeNotifier.Connect\'
63 - '\Outlook\Addins\UCAddin.LyncAddin.1'
64 - '\Outlook\Addins\UCAddin.UCAddin.1'
65 - '\Outlook\Addins\UmOutlookAddin.FormRegionAddin\'
66 - 'AddinTakeNotesService\FriendlyName'
67 filter_main_officeclicktorun:
68 Image|startswith:
69 - 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'
70 - 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\'
71 Image|endswith: '\OfficeClickToRun.exe'
72 filter_optional_avg:
73 Image:
74 - 'C:\Program Files\AVG\Antivirus\RegSvr.exe'
75 - 'C:\Program Files\AVG\Antivirus\x86\RegSvr.exe'
76 TargetObject|contains: '\Microsoft\Office\Outlook\Addins\Antivirus.AsOutExt\'
77 filter_optional_avast:
78 Image:
79 - 'C:\Program Files\Avast Software\Avast\RegSvr.exe'
80 - 'C:\Program Files\Avast Software\Avast\x86\RegSvr.exe'
81 TargetObject|contains: '\Microsoft\Office\Outlook\Addins\Avast.AsOutExt\'
82 condition: all of selection_office_* and not 1 of filter_main_* and not 1 of filter_optional_*
83fields:
84 - SecurityID
85 - ObjectName
86 - OldValueType
87 - NewValueType
88falsepositives:
89 - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason
90 - Legitimate administrator sets up autorun keys for legitimate reason
91level: medium
References
Related rules
- Classes Autorun Keys Modification
- Common Autorun Keys Modification
- CurrentControlSet Autorun Keys Modification
- CurrentVersion Autorun Keys Modification
- CurrentVersion NT Autorun Keys Modification