T1137.006

Official Description

Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs. (Citation: Microsoft Office Add-ins) There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins. (Citation: MRWLabs Office Persistence Add-ins)(Citation: FireEye Mail CDS 2018)

Add-ins can be used to obtain persistence because they can be set to execute code when an Office application starts.

Tactics: Persistence
Platforms: Windows, Office Suite
Parent Technique: T1137 · Office Application Startup
MITRE Version: 1.2
Last Modified: Oct 24, 2025

View on MITRE ATT&CK ↗

Reported Context (1)

Advertisements include Office COM add-ins. Report Details How Malware Crypting Services Help Threat Actors Evade Detection

Malware (16)

Threat Actors (2)

MITRE ATT&CK (68)

Vendors (17)

Products (21)

Tools (11)

Industries (1)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.