MITRE ATT&CKsub-technique

T1137.006 Add-ins

Published 2019-11-07 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Persistence
Platforms
Windows, Office Suite
Version
1.2
Created
2019-11-07

Description

Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs. There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins. Add-ins can be used to obtain persistence because they can be set to execute code when an Office application starts.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1137 Office Application Startup technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1040 Behavior Prevention on Endpoint mitigation

Referenced by MITRE ATT&CK · uses (4)

  • S1143 LunarLoader software (malware)
  • S1142 LunarMail software (malware)
  • S0268 Bisonal software (malware)
  • G0019 Naikon group

Referenced by Compliance · mitigates (9)

  • CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-9.4 Restrict Unnecessary or Unauthorized Browser and Email Client Extensions CIS Safeguard v8.1
  • CIS-9.6 Block Unnecessary File Types CIS Safeguard v8.1
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-SC-18 Mobile Code NIST 800-53 control
  • NIST-SC-44 Detonation Chambers NIST 800-53 control
  • NIST-SI-8 Spam Protection NIST 800-53 control

References