T1137 Office Application Startup
Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Code Executed Via Office Add-in XLL Filehightest · windows
- Outlook Macro Execution Without Warning Setting Enabledhightest · windows
- Potential Persistence Via Excel Add-in - Registryhightest · windows
- Potential Persistence Via Microsoft Office Add-Inhightest · windows
- Potential Persistence Via Microsoft Office Startup Folderhightest · windows
- Potential Persistence Via Outlook Formhightest · windows
- Potential Persistence Via Outlook LoadMacroProviderOnBoot Settinghightest · windows
- Suspicious Microsoft Office Child Process - MacOShightest · macos
- Suspicious Outlook Macro Createdhightest · windows
- IE Change Domain Zonemediumtest · windows
- New Outlook Macro Createdmediumtest · windows
- Office Application Startup - Office Testmediumtest · windows
- Outlook Security Settings Updated - Registrymediumtest · windows
- Potential Persistence Via Visual Studio Tools for Officemediumtest · windows
- Registry Modification to Hidden File Extensionmediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.