> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/persistence/registry/office-add-ins.md).

# Office Add-ins

## Overview

* **Registry Location**: The specific registry path for Office Add-ins depends on the Office application and version. A general pattern for these paths is:
  * `HKCU\Software\Microsoft\Office\[Office Version]\[Application]\Addins`
* **Purpose and Use**: Add-ins can range from productivity tools, such as grammar checkers and citation managers, to enterprise-specific integrations like CRM and project management tools. They're developed using various technologies, including COM add-ins, VSTO (Visual Studio Tools for Office), and Office Web Add-ins.

## Abuse by Threat Actors

* **Malicious Add-ins**: Threat actors can create or modify registry entries to load malicious add-ins when an Office application starts. These add-ins can perform a wide range of malicious activities, from data exfiltration to executing further payloads.
* **Persistence and Stealth**: Once installed, a malicious add-in can provide persistent execution of malicious code each time the Office application is launched. Given that users frequently open Office applications, this provides a reliable method for maintaining access. Moreover, users might not suspect add-ins as a source of compromise, granting malware stealth.

## Detection and Mitigation

* **Monitoring Registry Changes**: Regular monitoring of the Add-ins registry keys for unexpected or unauthorized changes can help identify the installation of malicious add-ins. This can be achieved through security solutions that track registry modifications.
* **Office Application Behavior Analysis**: Analyzing behavior anomalies in Office applications, such as unexpected network connections or file modifications, can help detect malicious add-in activity.
* **Security Solutions and Policies**: Employ endpoint security solutions capable of detecting and blocking malicious add-ins. Establishing policies that control the installation and management of Office add-ins can limit the attack surface.

## Example of a Suspicious Entry

For Microsoft Word 2016, a suspicious add-in entry might look like this:

```powershell
[HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Addins\MyMaliciousAddIn]
"Description"="My Malicious Add-In"
"FriendlyName"="MyMaliciousAddIn"
"LoadBehavior"=dword:00000003
```

* **LoadBehavior**: Determines how the add-in is loaded. A value of `3` indicates the add-in is loaded at startup.
* **Description and FriendlyName**: These might be crafted to appear benign or mimic legitimate add-ins, making detection harder.

## Conclusion

While Office Add-ins are a powerful feature for extending the capabilities of Office applications, their potential misuse for malicious purposes cannot be ignored. Organizations should implement strict controls over add-in management, conduct regular audits of registry settings related to add-ins, and employ advanced security solutions to detect and mitigate threats posed by malicious add-ins. Awareness and proactive management of add-ins are crucial for maintaining a secure computing environment.