Office Application Startup: Office Template Macros T1137.001

Tactic: Persistence

Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts.

Authoring guide

These 2 rules share fields, values, and exclusions.

Fields filtered most (9 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
TargetFilename2wildcard 2?:\users\*\appdata\roaming\microsoft\outlook\vbaproject.otm, \device\harddiskvolume*\users\*\appdata\roaming\microsoft..., c:\users\*\appdata\roaming\microsoft\excel\xlstart\personal.xlsb, c:\users\*\appdata\roaming\microsoft\templates\normal.dotm
EventType1in 1creation, overwrite
event.type1ne 1deletion
file.name1eq 1vbaproject.otm
file.size1gt 10
host.os.type1eq 1
process_id1ne 14
process_name1is_not_null 1
user1is_not_null 1

Top indicator values (10 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
EventTypein
creation
134
EventTypein
overwrite
17
TargetFilenamewildcard
?:\users\*\appdata\roaming\microsoft\outlook\vbaproject.otm
1
TargetFilenamewildcard
\device\harddiskvolume*\users\*\appdata\roaming\microsoft\outlook\vbaproject.otm
1
TargetFilenamewildcard
c:\users\*\appdata\roaming\microsoft\excel\xlstart\personal.xlsb
1
TargetFilenamewildcard
c:\users\*\appdata\roaming\microsoft\templates\normal.dotm
1
event.typene
deletion
132
file.nameeq
vbaproject.otm
1
file.sizegt
0
13
process_idne
4
145

Exclusions (20 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
Imagewildcard
?:\program files (x86)\citrix\user profile manager\userprofilemanager.exe
1
Imagewildcard
?:\program files (x86)\ivanti\workspace control\pfwsmgr.exe
1
Imagewildcard
?:\program files (x86)\laplink pcmover\pcmoverhost.exe
1
Imagewildcard
?:\program files\citrix\user profile manager\userprofilemanager.exe
1
Imagewildcard
?:\program files\veeam\endpoint backup\*.exe
1
Imagewildcard
?:\programdata\forensit\transwiz\deployment files\transwiz.exe
1
Imagewildcard
?:\windows\explorer.exe
1
Imagewildcard
?:\windows\sys*\robocopy.exe
1
Imagewildcard
?:\windows\sys*\xcopy.exe
1
Imagewildcard
?:\windows\system32\dllhost.exe
1
Imagewildcard
?:\windows\system32\svchost.exe
1
Imagewildcard
\device\mup\*.exe
1
Imagewildcard
c:\program files (x86)\windows kits\10\assessment and deployment kit\user...
1
Imagewildcard
c:\windows\system32\cmd.exe
1
Imagewildcard
d:\supergrate*.exe
1

Rules under this technique

These vendors publish rules tagged with this technique.

Domain: Endpoint

Platform (all)

Elastic 2 rules