T1137 Office Application Startup Mappings

Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.

A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: TechNet O365 Outlook Rules)



Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
cloud_ids Cloud IDS technique_scores T1137 Office Application Startup
chronicle Chronicle technique_scores T1137 Office Application Startup

ATT&CK Subtechniques

Technique ID Technique Name Number of Mappings
T1137.006 Add-ins 1
T1137.001 Office Template Macros 2