Detecting Office Add-in, Template and Outlook Persistence

Microsoft Office offers several extension points that run code when an application starts or a trigger fires: global templates like Normal.dotm, STARTUP folders, COM and VSTO add-ins, native XLL and WLL add-ins, and Outlook rules, forms and home pages. Attackers use them to persist inside a trusted process, often after an initial macro or phishing foothold. Detection rests on file writes to the extension folders, add-in registry keys and unusual child processes of Office applications.

Signals at a Glance

Templates, Startup Folders and Add-in Keys

A modified Normal.dotm executes its macros every time Word starts. Word legitimately rewrites that file when a user changes defaults, so the signal is a write by a process other than Word, or a macro-enabled template appearing in the STARTUP folders. Add-ins register under per-user keys that need no admin rights. This KQL covers both:

// KQL: Office extension files and add-in registrations
let extFiles = DeviceFileEvents
    | where ActionType in ("FileCreated", "FileModified")
    | where FolderPath has_any (@"\Microsoft\Templates", @"\Microsoft\Word\STARTUP",
                                @"\Microsoft\Excel\XLSTART", @"\Microsoft\AddIns")
    | where FileName endswith ".dotm" or FileName endswith ".wll" or FileName endswith ".xll"
         or FileName endswith ".xlam" or FileName endswith ".xla"
    | where InitiatingProcessFileName !in~ ("WINWORD.EXE", "EXCEL.EXE")
    | project Timestamp, DeviceName, Signal = "office_ext_file", Detail = FolderPath, FileName,
              InitiatingProcessFileName, InitiatingProcessCommandLine;
let addinKeys = DeviceRegistryEvents
    | where ActionType == "RegistryValueSet"
    | where RegistryKey has @"\Microsoft\Office" and RegistryKey has @"\Addins\"
    | where RegistryValueName in~ ("LoadBehavior", "Manifest")
    | project Timestamp, DeviceName, Signal = "addin_key", Detail = RegistryKey, FileName = RegistryValueName,
              InitiatingProcessFileName, InitiatingProcessCommandLine;
union extFiles, addinKeys
| order by Timestamp desc
// tune/validate: enterprise add-ins (PDF, CRM, Teams) register here; allowlist by ProgID and writer.

Outlook Rules, Forms and Fleet Inventory

Outlook persistence typically relies on a mailbox rule or custom form that runs when a message arrives. Microsoft disabled the start-application rule action and form scripting by default after public tooling made them practical, so attackers must re-enable them through registry settings. That makes the configuration changes a precise signal. Inventory add-ins directly to catch anything that predates your telemetry:

# PowerShell: inventory Office add-ins (per-user and per-machine) and key Outlook policy values
$roots = 'HKCU:\Software\Microsoft\Office',
         'HKLM:\SOFTWARE\Microsoft\Office',
         'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Office'
foreach ($r in $roots) {
  Get-ChildItem $r -Recurse -ErrorAction SilentlyContinue |
    Where-Object { $_.PSPath -match '\\Addins\\[^\\]+$' } |
    ForEach-Object {
      $p = Get-ItemProperty $_.PSPath
      [pscustomobject]@{ Key = $_.Name; LoadBehavior = $p.LoadBehavior; Manifest = $p.Manifest
                         FriendlyName = $p.FriendlyName }
    }
}
Get-ChildItem 'HKCU:\Software\Microsoft\Office\*\Outlook\Security' -ErrorAction SilentlyContinue |
  Get-ItemProperty | Select-Object PSPath, EnableUnsafeClientMailRules
# tune/validate: compare to a gold image; unknown ProgIDs with LoadBehavior 3 are the interesting set.

• Alert on OUTLOOK.EXE, WINWORD.EXE or EXCEL.EXE spawning cmd.exe, powershell.exe, mshta.exe or wscript.exe, which covers rule, form and macro triggers alike.
• Detect EnableUnsafeClientMailRules and Outlook form-security policy values being set outside Group Policy.
• Review mailbox rules centrally with Exchange or Microsoft 365 audit logs and flag new rules that forward, delete or run an application.
• Reduce exposure with Group Policy: block macros from the internet, disable VBA in templates where unneeded, and restrict trusted locations and add-in installation.