Office Application Startup T1137

Tactic: Persistence

Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.

Events covered

8 catalog events are tagged with this technique by at least one rule.

Authoring guide

These 34 rules share fields, values, and exclusions.

Fields filtered most (39 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
TargetObject12contains 7, ends_with 4, wildcard 2\software\microsoft\office\, *\software\microsoft\office\*\outlook\today\*, *\software\microsoft\office\*\outlook\webview\*, \excel\options, \microsoft\office\outlook\addins\antivirus.asoutext\
TargetFilename10ends_with 5, wildcard 4, contains 3\microsoft\outlook\vbaproject.otm, .doc, .docm, .docx, .ppam
EventType9ne 4, in 3, eq 2deletion, new-inboxrule, set-inboxrule, start, creation
Details8eq 4, contains 2, ends_with 1, starts_with 1, wildcard 10x00000001, dword (0x00000001), (empty), *://*, *:\*
Image7ends_with 7, starts_with 2, eq 1\outlook.exe, \excel.exe, /bash, /curl, /dash
host.os.type5eq 5
process_name4eq 3, is_not_null 1excel.exe, msaccess.exe, powerpnt.exe, winword.exe
event.type3ne 2, eq 1deletion, start
registry_value_name3eq 3level, loadmacroprovideronboot, url
data_stream.dataset2eq 2o365.audit
event.outcome2eq 2success
parent_process_name2eq 2cmd.exe, excel.exe, explorer.exe, openwith.exe, winword.exe
process.args2eq 1, regex_match 1, wildcard 1-xlls, .+\.(wll|xll|ppa|ppam|xla|xlam|vsto), ?:\ProgramData\*, ?:\Users\*\AppData\Roaming\*
registry_path2contains 2\\outlook\\, \\outlook\\security
Esql.inbox_rule_name1regex_match 1[!@#$%^&*()_+={[\]|\\:;"'<,>.?/~` \-]+

Top indicator values (211 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
Imageends_with
\outlook.exe
513
Imageends_with
\excel.exe
216
Imageends_with
\winword.exe
217
Imageends_with
/bash
113
Imageends_with
/curl
122
EventTypene
deletion
486
process_nameeq
excel.exe
334
process_nameeq
winword.exe
235
Detailscontains
0x00000001
24
Detailseq
0x00000001
261
Detailseq
dword (0x00000001)
240
Detailseq
(empty)
12
Detailseq
dword (0x00000000)
138
Detailseq
dword (0x00000002)
110
EventTypeeq
start
2391
EventTypein
new-inboxrule
22
EventTypein
set-inboxrule
22
EventTypein
creation
134
EventTypein
overwrite
17
TargetFilenameends_with
\microsoft\outlook\vbaproject.otm
22
TargetObjectcontains
\software\microsoft\office\
24
data_stream.dataseteq
o365.audit
247
event.outcomeeq
success
2369
event.typene
deletion
232
Detailsends_with
.xll
1
Detailsstarts_with
/R
1
Detailswildcard
*://*
1
Detailswildcard
*:\*
1
Detailswildcard
\\*\*
1
Esql.inbox_rule_nameregex_match
[!@#$%^&*()_+={[\]|\\:;"'<,>.?/~` \-]+
1

Exclusions (98 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
Imageends_with
\outlook.exe
3
Imageends_with
\excel.exe
2
Imageends_with
\winword.exe
2
dll.code_signature.statuswildcard
errorCode_endpoint*
2
dll.code_signature.statuswildcard
errorExpired
2
process.code_signature.trustedeq
true
2
Detailseq
(empty)
1
Detailseq
dword (0x00000000)
1
Detailseq
dword (0x00000001)
1
Hasheseq
20a33e2b3bf3da40a44b2001b60fbdac5e047154a169d77170b2ef7b0f5ae75a
1
Hasheseq
582098e0e01d7beddd8f63333569aac96e06bfcef2d1ce61a9fddd99f651caf1
1
Hasheseq
6e5fab5ccee725eb32144e36e1f0486f892ed99ad85e8d6a0354ced2eeed3759
1
Hasheseq
77fbc709353e2fc68091ef4eaf92d9926b1f36201e1cb5c59583867c6b8979e2
1
Hasheseq
83fd2689932d14a23f17de26ddc201f5a9f69060f550992feb421396c6914b06
1
Hasheseq
a5b7f6173251349613213e8ee0517e7677c03367b213d70d62f0f251283c3253
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 16 rules

Elastic 13 rules

Splunk 3 rules

Kusto 1 rule

Panther 1 rule