Office Add-Ins
Add-ins Office loads at startup, with LoadBehavior deciding whether they load.
Use it to list the add-ins each Office application loads at startup, and spot one that does not belong.
- NTUSER.DAT
- Persistence
What It Is
Microsoft Office loads add-ins at startup from Addins keys, with one subkey per add-in under the Office application's key. Each entry has a LoadBehavior value that tells the application when to load the add-in and records whether it is loaded, with 3 meaning load at startup. Other values include a Description, a FriendlyName shown in the add-ins dialogue and a Manifest path. The per-user entries live in the user's NTUSER.DAT hive, and machine-wide entries under HKLM.
What It Proves
An add-in registered under an Office application with LoadBehavior set to 3 is loaded and connected each time that application starts. It is a supported extension point an attacker can abuse.
What It Does Not Prove
Genuine add-ins fill these keys, so judge by the add-in target and publisher. LoadBehavior set to 0 or 2 means it is present but does not load automatically.
Where It Lives
Office Add-Ins lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
NTUSER.DAT\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| alice's Outlook has the Teams Meeting Add-in registered, a genuine Microsoft add-in. Resolve its ProgID to the DLL to confirm the publisher. |
| LoadBehavior 3 loads it each time Outlook starts, the usual setting for this add-in. Judge an add-in by its DLL and publisher, not by this value. |
| Excel's Acrobat PDFMaker add-in has LoadBehavior 2, so it no longer loads at start. A user turned it off or a load failed, so resolve its DLL before ruling it out. |
How to Read It
List add-ins under each Office application, such as Word, Excel and Outlook. Read LoadBehavior, where 3 loads at startup, 9 or 16 on demand, and 0 or 2 not automatically. Resolve the add-in to its DLL, manifest or document and check where it lives.
- When Windows Writes It
- When an add-in is installed or its LoadBehavior changes.
- Which Windows Versions
- Microsoft Office on Windows 7 to 11
- Tools That Parse It
- Autoruns, Registry Explorer, RECmd
Hunt It
Microsoft does not say which keys Defender records, so confirm it records these first. A hit shows an add-in registered, not that it loaded. A LoadBehavior of 3 on a new add-in is the one to review.
// Add-ins registered or set to load under OfficeDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Office Add-Ins shows.
- Office Application Loads a DLL, Sysmon Event 7Not in the RegistryShows the add-in actually loading when the Office app starts.
Sources
The facts on this page come from these public pages, which say more on each point.