Potential Persistence Via Visual Studio Tools for Office

Action1: actionname = "Registry value modified" AND (OBJECTNAME contains "\Software\Microsoft\Office\Outlook\Addins\,\Software\Microsoft\Office\Word\Addins\,\Software\Microsoft\Office\Excel\Addins\,\Software\Microsoft\Office\Powerpoint\Addins\,\Software\Microsoft\VSTO\Security\Inclusion" OR ((OBJECTNAME endswith "\Software\Microsoft\Office\Outlook\Addins" AND isExist(OBJECTVALUENAME)) OR (OBJECTNAME endswith "\Software\Microsoft\Office\Word\Addins" AND isExist(OBJECTVALUENAME)) OR (OBJECTNAME endswith "\Software\Microsoft\Office\Excel\Addins" AND isExist(OBJECTVALUENAME)) OR (OBJECTNAME endswith "\Software\Microsoft\Office\Powerpoint\Addins" AND isExist(OBJECTVALUENAME)) OR (OBJECTNAME endswith "\Software\Microsoft\VSTO\Security\Inclusion" AND isExist(OBJECTVALUENAME)))) AND (PROCESSNAME notendswith "\msiexec.exe,\regsvr32.exe" AND PROCESSNAME notendswith "\excel.exe,\integrator.exe,\OfficeClickToRun.exe,\winword.exe,\visio.exe" AND PROCESSNAME notendswith "\Teams.exe" AND (PROCESSNAME != "C:\Program Files\AVG\Antivirus\RegSvr.exe" OR (OBJECTNAME notcontains "\Microsoft\Office\Outlook\Addins\Antivirus.AsOutExt" AND (OBJECTNAME notendswith "\Microsoft\Office\Outlook\Addins\Antivirus.AsOutExt" OR isNotExist(OBJECTVALUENAME))))) select Action1.HOSTNAME,Action1.MESSAGE,Action1.OBJECTNAME,Action1.PROCESSNAME,Action1.PREVVAL,Action1.CHANGES