Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.
A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: TechNet O365 Outlook Rules)
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name |
|---|---|---|---|---|
| cloud_ids | Cloud IDS | technique_scores | T1137 | Office Application Startup |
| chronicle | Chronicle | technique_scores | T1137 | Office Application Startup |
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1137.006 | Add-ins | 1 |
| T1137.001 | Office Template Macros | 2 |