Suspicious Microsoft Office add-in loaded

Identifies attempts to load unsigned executables from known Microsoft Office add-ins directories, which adversaries may exploit to maintain persistence.

• Platform: Windows
• Severity: High
• MITRE Tactic: Persistence
• MITRE Techniques: T1137

Back to all rules