Office Autorun Keys Modification

 1title: Office Autorun Keys Modification
 2id: baecf8fb-edbf-429f-9ade-31fc3f22b970
 3related:
 4    - id: 17f878b8-9968-4578-b814-c4217fc5768c
 5      type: obsolete
 6status: test
 7description: Detects modification of autostart extensibility point (ASEP) in registry.
 8references:
 9    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
10    - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
11    - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d # a list with registry keys
12author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
13date: 2019-10-25
14modified: 2025-10-17
15tags:
16    - attack.privilege-escalation
17    - attack.persistence
18    - attack.t1547.001
19logsource:
20    category: registry_set
21    product: windows
22detection:
23    selection_office_root:
24        TargetObject|contains:
25            - '\Software\Wow6432Node\Microsoft\Office'
26            - '\Software\Microsoft\Office'
27    selection_office_details:
28        TargetObject|contains:
29            - '\Word\Addins'
30            - '\PowerPoint\Addins'
31            - '\Outlook\Addins'
32            - '\Onenote\Addins'
33            - '\Excel\Addins'
34            - '\Access\Addins'
35            - 'test\Special\Perf'
36    filter_main_empty:
37        Details: '(Empty)'
38    filter_main_known_addins:
39        Image|startswith:
40            - 'C:\Program Files\Microsoft Office\'
41            - 'C:\Program Files (x86)\Microsoft Office\'
42            - 'C:\Windows\System32\msiexec.exe'
43            - 'C:\Windows\System32\regsvr32.exe'
44        TargetObject|contains:
45            # Remove any unused addins in your environment from the filter
46            # Known addins for excel
47            - '\Excel\Addins\AdHocReportingExcelClientLib.AdHocReportingExcelClientAddIn.1\'
48            - '\Excel\Addins\ExcelPlugInShell.PowerMapConnect\'
49            - '\Excel\Addins\NativeShim\'
50            - '\Excel\Addins\NativeShim.InquireConnector.1\'
51            - '\Excel\Addins\PowerPivotExcelClientAddIn.NativeEntry.1\'
52            # Known addins for outlook
53            - '\Outlook\AddIns\AccessAddin.DC\'
54            - '\Outlook\AddIns\ColleagueImport.ColleagueImportAddin\'
55            - '\Outlook\AddIns\EvernoteCC.EvernoteContactConnector\'
56            - '\Outlook\AddIns\EvernoteOLRD.Connect\'
57            # - '\Outlook\Addins\GrammarlyAddIn.Connect' # Uncomment if you use Grammarly
58            - '\Outlook\Addins\Microsoft.VbaAddinForOutlook.1\'
59            - '\Outlook\Addins\OcOffice.OcForms\'
60            - '\Outlook\Addins\\OneNote.OutlookAddin'
61            - '\Outlook\Addins\OscAddin.Connect\'
62            - '\Outlook\Addins\OutlookChangeNotifier.Connect\'
63            - '\Outlook\Addins\UCAddin.LyncAddin.1'
64            - '\Outlook\Addins\UCAddin.UCAddin.1'
65            - '\Outlook\Addins\UmOutlookAddin.FormRegionAddin\'
66            - 'AddinTakeNotesService\FriendlyName'
67    filter_main_officeclicktorun:
68        Image|startswith:
69            - 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'
70            - 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\'
71        Image|endswith: '\OfficeClickToRun.exe'
72    filter_optional_avg:
73        Image:
74            - 'C:\Program Files\AVG\Antivirus\RegSvr.exe'
75            - 'C:\Program Files\AVG\Antivirus\x86\RegSvr.exe'
76        TargetObject|contains: '\Microsoft\Office\Outlook\Addins\Antivirus.AsOutExt\'
77    filter_optional_avast:
78        Image:
79            - 'C:\Program Files\Avast Software\Avast\RegSvr.exe'
80            - 'C:\Program Files\Avast Software\Avast\x86\RegSvr.exe'
81        TargetObject|contains: '\Microsoft\Office\Outlook\Addins\Avast.AsOutExt\'
82    condition: all of selection_office_* and not 1 of filter_main_* and not 1 of filter_optional_*
83fields:
84    - SecurityID
85    - ObjectName
86    - OldValueType
87    - NewValueType
88falsepositives:
89    - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason
90    - Legitimate administrator sets up autorun keys for legitimate reason
91level: medium