Esc

Add-ins - T1137.006

(ATT&CK® Technique)

Definition

Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs. There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins.

D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.

        graph LR;

     T1137006["Add-ins"] --> |adds| Software["Software"]; class T1137006 OffensiveTechniqueNode;
        class Software ArtifactNode; click Software href "/dao/artifact/d3f:Software";
        click T1137006 href "/offensive-technique/attack/T1137.006/"; click Software href "/dao/artifact/d3f:Software"; T1137006["Add-ins"] --> |may-modify| SystemConfigurationDatabase["System Configuration Database"]; class T1137006 OffensiveTechniqueNode;
        class SystemConfigurationDatabase ArtifactNode; click SystemConfigurationDatabase href "/dao/artifact/d3f:SystemConfigurationDatabase";
        click T1137006 href "/offensive-technique/attack/T1137.006/"; click SystemConfigurationDatabase href "/dao/artifact/d3f:SystemConfigurationDatabase"; T1137006["Add-ins"] --> |modifies| OfficeApplication["Office Application"]; class T1137006 OffensiveTechniqueNode;
        class OfficeApplication ArtifactNode; click OfficeApplication href "/dao/artifact/d3f:OfficeApplication";
        click T1137006 href "/offensive-technique/attack/T1137.006/"; click OfficeApplication href "/dao/artifact/d3f:OfficeApplication";                                       RestoreSoftware["Restore Software"] -->
          | restores | Software["Software"];

          RestoreSoftware["Restore Software"] -.->
            | may-restore | T1137006["Add-ins"] ;
          class RestoreSoftware DefensiveTechniqueNode;
          class Software ArtifactNode;
          click RestoreSoftware href "/technique/d3f:RestoreSoftware";                                                                    RestoreSoftware["Restore Software"] -->
          | restores | OfficeApplication["Office Application"];

          
          class RestoreSoftware DefensiveTechniqueNode;
          class OfficeApplication ArtifactNode;
          click RestoreSoftware href "/technique/d3f:RestoreSoftware"; RestoreDatabase["Restore Database"] -->
          | restores | SystemConfigurationDatabase["System Configuration Database"];

          RestoreDatabase["Restore Database"] -.->
            | may-restore | T1137006["Add-ins"] ;
          class RestoreDatabase DefensiveTechniqueNode;
          class SystemConfigurationDatabase ArtifactNode;
          click RestoreDatabase href "/technique/d3f:RestoreDatabase";                                           SystemConfigurationPermissions["System Configuration Permissions"] -->
          | restricts | SystemConfigurationDatabase["System Configuration Database"];

          SystemConfigurationPermissions["System Configuration Permissions"] -.->
            | may-harden | T1137006["Add-ins"] ;
          class SystemConfigurationPermissions DefensiveTechniqueNode;
          class SystemConfigurationDatabase ArtifactNode;
          click SystemConfigurationPermissions href "/technique/d3f:SystemConfigurationPermissions"; SoftwareUpdate["Software Update"] -->
          | updates | OfficeApplication["Office Application"];

          SoftwareUpdate["Software Update"] -.->
            | may-harden | T1137006["Add-ins"] ;
          class SoftwareUpdate DefensiveTechniqueNode;
          class OfficeApplication ArtifactNode;
          click SoftwareUpdate href "/technique/d3f:SoftwareUpdate"; SoftwareUpdate["Software Update"] -->
          | updates | Software["Software"];

          
          class SoftwareUpdate DefensiveTechniqueNode;
          class Software ArtifactNode;
          click SoftwareUpdate href "/technique/d3f:SoftwareUpdate";

json