Office Application Startup

T1137

Technique with 6 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.

A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page. These persistence mechanisms can work within Outlook or be used through Office 365.

Detection rules18

Rules on DetectionCode tagged with T1137 or one of its sub-techniques.

Sigma15

Rule	Level	Log source	Technique
Code Executed Via Office Add-in XLL File	high	windows / ps_script	T1137.006
Outlook Macro Execution Without Warning Setting Enabled	high	windows / registry_set	T1137
Potential Persistence Via Excel Add-in - Registry	high	windows / registry_set	T1137.006
Potential Persistence Via Microsoft Office Add-In	high	windows / file_event	T1137.006
Potential Persistence Via Microsoft Office Startup Folder	high	windows / file_event	T1137
Potential Persistence Via Outlook Form	high	windows / file_event	T1137.003
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting	high	windows / registry_set	T1137
Suspicious Microsoft Office Child Process - MacOS	high	macos / process_creation	T1137.002
Suspicious Outlook Macro Created	high	windows / file_event	T1137
IE Change Domain Zone	medium	windows / registry_set	T1137
New Outlook Macro Created	medium	windows / file_event	T1137
Office Application Startup - Office Test	medium	windows / registry_event	T1137.002
Outlook Security Settings Updated - Registry	medium	windows / registry_set	T1137
Potential Persistence Via Visual Studio Tools for Office	medium	windows / registry_set	T1137.006
Registry Modification to Hidden File Extension	medium	windows / registry_set	T1137

Splunk3

Rule	Type	Risk	Data source	Technique
Windows Outlook LoadMacroProviderOnBoot Persistence	TTP	NULL	Sysmon EventID 13	T1137
Windows Outlook Macro Created by Suspicious Process	TTP	NULL	Sysmon EventID 11	T1137
Windows Outlook Macro Security Modified	TTP	NULL	Sysmon EventID 13	T1137

Sub-techniques6

ID	Name	Examples
T1137.001	Office Template Macros	5
T1137.002	Office Test	1
T1137.003	Outlook Forms	1
T1137.004	Outlook Home Page	2
T1137.005	Outlook Rules	1
T1137.006	Add-ins	4

Groups2

APT32 Gamaredon Group

Software0

None recorded.

Campaigns0

None recorded.

Procedure examples2

Groups2

Used by	Procedure example
GroupAPT32	APT32 have replaced Microsoft Outlook's VbaProject.OTM file to install a backdoor macro for persistence. Cybereason Cobalt Kitty 2017 Cybereason Oceanlotus May 2017
GroupGamaredon Group	Gamaredon Group has inserted malicious macros into existing documents, providing persistence when they are reopened. Gamaredon Group has loaded the group's previously delivered VBA project by relaunching Microsoft Outlook with the `/altvba` option, once the Application.Startup event is received. ESET Gamaredon June 2020

References2

SensePost Ruler GitHub Open source
SensePost. (2016, August 18). Ruler: A tool to abuse Exchange services. Retrieved February 4, 2019.
TechNet O365 Outlook Rules Open source
Koeller, B.. (2018, February 21). Defending Against Rules and Forms Injection. Retrieved November 5, 2019.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.