Techniques › T1137 › AN1116
AN1116 Analytic 1116
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Office-based persistence via Office template macros, Outlook forms/rules/homepage, or registry-persistent scripts. Adversary modifies registry keys or Office application directories to load malicious scripts at startup.</p>
- Detects
- T1137 Office Application Startup
- Part of
- DET0398 Detect Office Startup-Based Persistence via Macros, Forms, and Registry Hooks
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Sysmon | EventCode=13, 14 | DC0063 Windows Registry Key Modification |
| WinEventLog:Application | Outlook rule creation, form load, or homepage redirection | DC0038 Application Log Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ParentProcessName | Tune based on expected Office process tree (e.g., WINWORD.EXE spawning cmd.exe) |
RegistryPath | Specific keys related to Office startup such as Outlook Today, AddIns, or Template Macros |
TimeWindow | Window of process execution after user login or Outlook launch |
UserContext | Detect persistence within high-value user mailboxes (e.g., admin, finance, C-suite) |