T1137.006 Add-ins

Technique

T1137.006

Tactics

Persistence

Research, 90 days

1

KEV CVEs mapped

0

SigmaHQ rules

4

Elastic, Splunk

2

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1137/006

MITRE description

Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs.(Citation: Microsoft Office Add-ins) There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins.(Citation: MRWLabs Office Persistence Add-ins)(Citation: FireEye Mail CDS 2018) Add-ins can be used to obtain persistence because they can be set to execute code when an Office application starts.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-08-13 Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them

Detection coverage

SigmaHQ community rules

• Potential Persistence Via Microsoft Office Add-In (core)
• Code Executed Via Office Add-in XLL File (core)
• Potential Persistence Via Visual Studio Tools for Office (core)
• Potential Persistence Via Excel Add-in - Registry (core)

Elastic and Splunk rules

• Suspicious Execution via Microsoft Office Add-Ins (elastic)
• Persistence via Microsoft Office AddIns (elastic)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.