Hunting Specula C2 Framework and XLL Execution

This report analyzes the Specula C2 framework, an Outlook-based implant that hooks victims by modifying Outlook homepage registry keys to load attacker-controlled VBScript pages and stage malicious XLL (Excel Add-In) files; those XLLs are then executed via Excel COM automation to run arbitrary code. The blog includes operational details, example Sysmon and Zeek logs, hashing and file creation evidence, recommended detection points, and MITRE ATT&CK mappings.