Office Application Startup: Add-ins
- ID
- T1137.006
- Tactics
- TA0003 Persistence
- Sub-technique of
- T1137 Office Application Startup
- Platforms
- Windows, Office Suite
- Data sources
- Process Creation, File Creation, File Modification, Windows Registry Key Modification, Application Log Content, Command Execution
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs. [2] There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins. [3][4]
Add-ins can be used to obtain persistence because they can be set to execute code when an Office application starts.
Detection
- DET0050 Detect Persistence via Malicious Office Add-ins
Data components: Process Creation, File Creation, File Modification, Windows Registry Key Modification, Application Log Content, Command Execution
Mitigations (1)
- M1040 Behavior Prevention on Endpoint
On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Office applications from creating child processes and from writing potentially malicious executable content to disk. [1]