AN0137: Analytic 0137
An adversary writes or drops a malicious Office Add-in (e.g., WLL, XLL, COM) to a trusted directory or modifies registry keys to load malicious add-ins on Office application launch. Upon user opening Word or Excel, the add-in is automatically loaded, triggering execution of the payload, often spawning scripting engines or anomalous child processes.
Analyst context for executives and security teams
AN0137 describes malicious Microsoft Office add-ins on Windows: an attacker places or configures an add-in so Word or Excel loads it automatically, causing code execution when a user opens the application. The business significance is that normal productivity software can become an execution path that blends into trusted Office activity, making endpoint visibility, Office configuration governance, and incident triage quality important for resilience.
Executive priority
Treat this as a control-validation item for Windows endpoint security and Office hardening. Leaders should ask whether the organization can prove what Office add-ins are allowed, where add-ins can load from, which registry changes are monitored, and whether SOC teams can investigate Office spawning unusual child processes. This matters for business continuity because Office is widely used and trusted; weak monitoring can delay containment when user-facing productivity tools are abused.
Technical view
For SOC, detection engineering, and IR teams, validate visibility around Office add-in loading behavior on Windows. Focus on Office applications such as Word and Excel loading add-ins from trusted directories or through registry configuration, followed by suspicious process creation such as scripting engines or other anomalous child processes. Because the official ATT&CK object provides no detection text and no tactic mapping, teams should build local logic from endpoint telemetry, file/registry monitoring, process lineage, and known-good add-in baselines rather than assuming a complete analytic exists.
Likely telemetry
- Windows endpoint process creation with parent-child relationships for Word and Excel
- File creation or modification events in Office add-in locations and trusted directories
- Windows registry modification events for Office add-in loading configuration
- Office application execution and add-in load evidence where available
- Endpoint security alerts or EDR telemetry showing scripting engines or anomalous child processes launched by Office
Detection direction
- Baseline approved Office add-ins and expected load paths, then alert on new or unusual add-ins in trusted locations.
- Monitor registry keys that control Office add-in loading and prioritize changes not tied to approved software deployment activity.
- Correlate Word or Excel launches with immediate child processes, especially scripting engines or uncommon executables, while tuning for legitimate automation and business plug-ins.
- Use allowlisted add-in inventory and software deployment records to reduce false positives.
- Do not rely on ATT&CK-provided detection logic for this object; the official detection field is not supplied.
Mitigation priorities
- Establish governance for approved Office add-ins, including ownership, business justification, and change control.
- Restrict write access to trusted Office add-in directories to authorized administrators and deployment tooling.
- Monitor and control registry locations used to configure Office add-in loading.
- Harden endpoint policy around Office child-process behavior where operationally feasible.
- Ensure IR playbooks include collection of Office add-in files, registry configuration, and process lineage during suspicious Office execution investigations.
Analyst notes and limits
This take is based on AN0137, a MITRE detection analytic for Windows describing malicious Office add-ins such as WLL, XLL, or COM add-ins placed in trusted directories or configured through registry keys. No ATT&CK relationships, tactics, or official detection logic were supplied, so the practical guidance emphasizes validation areas rather than a specific detection rule.
The object does not include official detection text, relationship context, tactic mapping, procedure examples, mitigations, or data source fields. Local Office configuration, endpoint telemetry availability, approved add-in inventory, and business automation patterns are required to determine actual coverage and tuning.
Analytic 0137
An adversary writes or drops a malicious Office Add-in (e.g., WLL, XLL, COM) to a trusted directory or modifies registry keys to load malicious add-ins on Office application launch. Upon user opening Word or Excel, the add-in is automatically loaded, triggering execution of the payload, often spawning scripting engines or anomalous child processes.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 409bca24c5cb… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN0137Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.