Persisting with Microsoft Office Abusing Extensibility Options
Six Office-based persistence mechanisms using add-ins and extensibility features.
Summary
Microsoft Office Persistence
Microsoft Office is nearly ubiquitous on compromised workstations. Native Office functionality provides multiple persistence opportunities for red teamers.
Persistence Mechanisms
Six persistence mechanisms are discussed: WLL/XLL add-ins for Word/Excel (legacy DLL loading), VBA add-ins for Excel/PowerPoint, COM add-ins for all Office products, Automation add-ins for Excel, VBE add-ins for VBA products, and VSTO add-ins for all products.
Comparative Analysis
Each mechanism's advantages and disadvantages for red teamers are discussed. Complexity, privilege requirements, and VDI applicability inform mechanism selection.
Defense Perspective
Approaches for detection and prevention of Office persistence mechanisms are covered. Threat hunters and incident responders gain detection strategies for identifying Office-based persistence implants.
Related talks
Briefings·22 min
Hariharan Shanmugam
Apple's on device AI frameworks CoreML, Vision, AVFoundation enable powerful automation and advanced media processing.
Main Track 1·20 min
Dor Azouri
Exploiting Windows BITS service state files to inject jobs and execute code as NT AUTHORITY/SYSTEM.
Main Track 1·40 min
Marina Simakov, Igal Gofman
Lesser-known persistence mechanisms using Kerberos delegation and advanced authentication abuse.