Techniques › T1137
T1137 Office Application Startup
persistence — Windows, Office Suite · attack.mitre.org · JSON
1
MITRE detection strategy
2
analytics
9
Sigma rules tagged attack.t1137
0
KEV CVEs mapped here
<p>Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.</p><p>A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page. These persistence mechanisms can work within Outlook or be used through Office 365.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0398 Detect Office Startup-Based Persistence via Macros, Forms, and Registry Hooks v1.0
AN1116 WindowsOffice-based persistence via Office template macros, Outlook forms/rules/homepage, or registry-persistent scripts. Adversary modifies registry keys or Office application directories to load malicious scripts at startup.WinEventLog:Application
Outlook rule creation, form load, or homepage redirection→ DC0038 Application Log ContentTunable:ParentProcessNameRegistryPathTimeWindowUserContextAN1117 Office SuiteStartup-based persistence mechanisms within Microsoft Office Suite like template macros and home page redirects being configured through internal automation or client-side settings.m365:unifiedSet-Mailbox, Set-InboxRule, Set-MailboxFolderPermission→ DC0010 User Account ModificationTunable:RuleActionMailboxTargetTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1137
Author: Max Altgelt (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-06-02 (modified 2023-06-22) · logsource: product=windows category=file_event · 0e20c89d-2264-44ae-8238-aeeaba609ece
Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-02-08 · logsource: product=windows category=file_event · 117d3d3a-755c-4a61-b23e-9171146d094c
Detects the creation of a macro file for Outlook.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2021-04-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · 396ae3eb-4174-4b9b-880e-dc0364d78a19
Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module
Author: frack113
· 2022-01-22 (modified 2023-08-17) · logsource: product=windows category=registry_set · 45e112d0-7759-4c2a-aa36-9f8fb79d3393
Hides the file extension through modification of the registry
Author: frack113
· 2022-01-22 (modified 2023-08-17) · logsource: product=windows category=registry_set · 5df86130-4e95-4a54-90f7-26541b40aec2
Hides the file extension through modification of the registry
Author: @ScoubiMtl
· 2021-04-05 (modified 2023-02-08) · logsource: product=windows category=file_event · 8c31f563-f9a7-450c-bfa8-35f8f32f1f61
Detects the creation of a macro file for Outlook.
Author: frack113
· 2021-12-28 (modified 2026-01-09) · logsource: product=windows category=registry_set · c3cefdf4-6703-4e1c-bad8-bf422fc5015a
Detects changes to the registry values related to outlook security settings
Author: @ScoubiMtl
· 2021-04-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · e3b50fa5-3c3f-444e-937b-0a99d33731cd
Detects the modification of Outlook security setting to allow unprompted execution of macros.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-04-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · fc06e655-d98c-412f-ac76-05c2698b1cb2
Detects changes to the registry values related to outlook that indicates that a reminder was triggered for a Note or Task item. This could be a sign of exploitation of CVE-2023-23397. Further investigation is required to determine the success of an exploitation.