T1137 Office Application Startup
Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- Code Executed Via Office Add-in XLL Filehightest · windows
- Outlook Macro Execution Without Warning Setting Enabledhightest · windows
- Potential Persistence Via Excel Add-in - Registryhightest · windows
- Potential Persistence Via Microsoft Office Add-Inhightest · windows
- Potential Persistence Via Microsoft Office Startup Folderhightest · windows
- Potential Persistence Via Outlook Formhightest · windows
- Potential Persistence Via Outlook LoadMacroProviderOnBoot Settinghightest · windows
- Suspicious Microsoft Office Child Process - MacOShightest · macos
- Suspicious Outlook Macro Createdhightest · windows
- IE Change Domain Zonemediumtest · windows
- New Outlook Macro Createdmediumtest · windows
- Office Application Startup - Office Testmediumtest · windows
- Outlook Security Settings Updated - Registrymediumtest · windows
- Potential Persistence Via Visual Studio Tools for Officemediumtest · windows
- Registry Modification to Hidden File Extensionmediumtest · windows
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.