T1137Persistence
Office Application Startup
Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
9 Sigma rules tagged T1137Office Application StartupT11379 general rules
- Outlook Macro Execution Without Warning Setting Enabledhightest
- Potential Persistence Via Microsoft Office Startup Folderhightest
- Potential Persistence Via Outlook LoadMacroProviderOnBoot Settinghightest
- Suspicious Outlook Macro Createdhightest
- IE Change Domain Zonemediumtest
- New Outlook Macro Createdmediumtest
- Outlook Security Settings Updated - Registrymediumtest
- Registry Modification to Hidden File Extensionmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Office Application Startup
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.