Techniques › T1221 › AN1564
AN1564 Analytic 1564
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection of Office or document viewer processes (e.g., winword.exe) initiating network connections to remote templates or executing scripts due to manipulated template references (e.g., embedded in .docx, .rtf, or .dotm files), followed by suspicious child process creation (e.g., PowerShell).</p>
- Detects
- T1221 Template Injection
- Part of
- DET0566 Template Injection Detection - Windows
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TemplateURLPatterns | Can be tuned to flag known bad domains or external resources in template fields. |
ParentProcess | May be environment-specific; typically Word, Excel, PowerPoint. |
TimeWindow | Correlation window for process + network activity. |
ChildProcessAnomalyThreshold | Trigger when document-spawned child process deviates from expected profile. |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2022-22954 | VMware Workspace ONE Access and Identity Manager | Mapped |
| CVE-2023-22527 | Atlassian Confluence Data Center and Server | Mapped |
| CVE-2024-23692 | Rejetto HTTP File Server | Mapped |