Technique.View on attack.mitre.org
Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts. For example, Microsoft’s Office Open XML (OOXML) specification defines an XML-based format for Office documents (.docx, xlsx, .pptx) to replace older binary formats (.doc, .xls, .ppt). OOXML files are packed together ZIP archives compromised of various XML files, referred to as parts, containing properties that collectively define how a document is rendered.
Properties within parts may reference shared public resources accessed via online URLs. For example, template properties may reference a file, serving as a pre-formatted document blueprint, that is fetched when the document is loaded.
Adversaries may abuse these templates to initially conceal malicious code to be executed via user documents. Template references injected into a document may enable malicious payloads to be fetched and executed when the document is loaded. These documents can be delivered via other techniques such as Phishing and/or Taint Shared Content and may evade static detections since no typical indicators (VBA macro, script, etc.) are present until after the malicious payload is fetched. Examples have been seen in the wild where template injection was used to load malicious code containing an exploit.
Adversaries may also modify the *\template control word within an .rtf file to similarly conceal then download malicious code. This legitimate control word value is intended to be a file destination of a template file resource that is retrieved and loaded when an .rtf file is opened. However, adversaries may alter the bytes of an existing .rtf file to insert a template control word field to include a URL resource of a malicious payload.
This technique may also enable Forced Authentication by injecting a SMB/HTTPS (or other credential prompting) URL and triggering an authentication attempt.
Rules on DetectionCode tagged with T1221.
| Rule | Level | Log source |
|---|---|---|
| Server Side Template Injection Strings | high | NULL / webserver |
| Used by | Procedure example |
|---|---|
| GroupAPT28 | APT28 used weaponized Microsoft Word documents abusing the remote template function to retrieve a malicious macro. |
| GroupConfucius | Confucius has used a weaponized Microsoft Word document with an embedded RTF exploit. |
| GroupDarkHydrus | DarkHydrus used an open-source tool, Phishery, to inject malicious remote template URLs into Microsoft Word documents and then sent them to victims to enable Forced Authentication. |
| GroupDragonfly | Dragonfly has injected SMB URLs into malicious Word spearphishing attachments to initiate Forced Authentication. |
| GroupGamaredon Group | Gamaredon Group has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads. Gamaredon Group can also inject malicious macros or remote templates into documents already present on compromised systems. |
| GroupInception | Inception has used decoy documents to load malicious remote payloads via HTTP. |
| GroupMirrorFace | MirrorFace has used remote template injection to retrieve malicious payloads from the C2. |
| GroupTropic Trooper | Tropic Trooper delivered malicious documents with the XLSX extension, typically used by OpenXML documents, but the file itself was actually an OLE (XLS) document. |
| Used by | Procedure example |
|---|---|
| MalwareChaes | Chaes changed the template target of the settings.xml file embedded in the Word document and populated that field with the downloaded URL of the next payload. |
| MalwareWarzoneRAT | WarzoneRAT has been install via template injection through a malicious DLL embedded within a template RTF in a Word document. |
| Used by | Procedure example |
|---|---|
| CampaignFrankenstein | During Frankenstein, the threat actors used trojanized documents that retrieved remote templates from an adversary-controlled website. |
| CampaignOperation Dream Job | During Operation Dream Job, Lazarus Group used DOCX files to retrieve a malicious document template/DOTM file. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
