APT32G0050 ↗
Have replaced Microsoft Outlook's VbaProject.OTM file to install a backdoor macro for persistence.12
tfMITRE ATT&CK technique
Office Application Startup T1137
- Tactic
- Persistence
- Platforms
- Windows, Office Suite
- Version
- 1.4
- Created
- 14 December 2017
- Last modified
- 24 October 2025
- Contributors
- Nick Carr, Mandiant; Microsoft Threat Intelligence Center (MSTIC); Sahar Shukrun; Praetorian; Loic Jaquemet; Ricardo Dias
Sub-techniques 619 rules across the family · 12 mapped directly to T1137 · 3 of 6 carry rules
Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
2
Threat groups56th pct
Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.12
Detection rulesTop 21%
Detection rules79th percentile · 79% of ATT&CK techniques have this many detection rules written or fewer.Office Application Startup MITRE reference T1137
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Gamaredon GroupG0047 ↗
Has inserted malicious macros into existing documents, providing persistence when they are reopened. Gamaredon Group has loaded the group's previously delivered VBA project by relaunching Microsoft Outlook with the /altvba option, once the Application.Startup event is received.1
All 2 groups for this technique
Offense vs defense T1137
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 9Splunk ESCU (cumulative) · 3
first rule: 2020 Q2Office Application Startup detection strategy DET0398
MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Office Startup-Based Persistence via Macros, Forms, and Registry Hooks
2 platforms
AN1116 · Windows
Office-based persistence via Office template macros, Outlook forms/rules/homepage, or registry-persistent scripts. Adversary modifies registry keys or Office application directories to load malicious scripts at startup.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Application Log ContentDC0038 | WinEventLog:Application | Outlook rule creation, form load, or homepage redirection |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Sysmon | EventCode=13, 14 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ParentProcessName | Tune based on expected Office process tree (e.g., WINWORD.EXE spawning cmd.exe) |
| RegistryPath | Specific keys related to Office startup such as Outlook Today, AddIns, or Template Macros |
| TimeWindow | Window of process execution after user login or Outlook launch |
| UserContext | Detect persistence within high-value user mailboxes (e.g., admin, finance, C-suite) |
AN1117 · Office Suite
Startup-based persistence mechanisms within Microsoft Office Suite like template macros and home page redirects being configured through internal automation or client-side settings.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account ModificationDC0010 | m365:unified | Set-Mailbox, Set-InboxRule, Set-MailboxFolderPermission |
| Application Log ContentDC0038 | m365:mailboxaudit | Outlook rule creation or custom form deployment |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| RuleAction | Identify rule actions that execute scripts, forward emails externally, or start external content |
| MailboxTarget | Focus on users with sensitive roles or shared mailboxes |
| TimeWindow | Detect persistence artifacts created shortly after credential access or login from an unusual location |
On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Office applications from creating child processes and from writing potentially malicious executable content to disk.
Follow Office macro security best practices suitable for your environment. Disable Office VBA macros from executing. Disable Office add-ins. If they are required, follow best practices for securing them by requiring them to be signed and disabling user notification for allowing add-ins. For some add-ins types (WLL, VBA) additional mitigation is likely required as disabling add-ins in the Office Trust Center does not disable WLL nor does it prevent VBA code from executing.
For the Office Test method, create the Registry key used to execute it and set the permissions to "Read Control" to prevent easy access to the key without administrator permissions or requiring Privilege Escalation.
Update SoftwareM1051
For the Outlook methods, blocking macros may be ineffective as the Visual Basic engine used for these features is separate from the macro scripting engine. Microsoft has released patches to try to address each issue. Ensure KB3191938 which blocks Outlook Visual Basic and displays a malicious code warning, KB4011091 which disables custom forms by default, and KB4011162 which removes the legacy Home Page feature, are applied to systems.
Tests1Executorscmd 1Need elevation0 of 1Have prerequisites0Have cleanup1Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition