MirrorFaceG1054 ↗
Has used remote template injection to retrieve malicious payloads from the C2.1
tfMITRE ATT&CK technique
Template Injection T1221
- Tactic
- Stealth
- Platform
- Windows
- Version
- 2.0
- Created
- 17 October 2018
- Last modified
- 12 May 2026
- Contributors
- Brian Wiltse @evalstrings; Michael Raggi @aRtAGGI; Patrick Campbell, @pjcampbe11
Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts. For example, Microsoft’s Office Open XML (OOXML) specification defines an XML-based format for Office documents (.docx, xlsx, .pptx) to replace older binary formats (.doc, .xls, .ppt). OOXML files are packed together ZIP archives compromised of various XML files, referred to as parts, containing properties that collectively define how a document is rendered.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
8
Threat groupsTop 21%
Threat groups79th percentile · 79% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.2
Tools & malware51st pct
Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.2
Detection rules50th pct
Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.Template Injection MITRE reference T1221
Top 21%of all ATT&CK techniques for number of groups
8 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
ConfuciusG0142 ↗
Has used a weaponized Microsoft Word document with an embedded RTF exploit.1
InceptionG0100 ↗
Has used decoy documents to load malicious remote payloads via HTTP.1
Tropic TrooperG0081 ↗
Delivered malicious documents with the XLSX extension, typically used by OpenXML documents, but the file itself was actually an OLE (XLS) document.1
DarkHydrusG0079 ↗
Used an open-source tool, Phishery, to inject malicious remote template URLs into Microsoft Word documents and then sent them to victims to enable Forced Authentication.1
Gamaredon GroupG0047 ↗
Has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads.1 Gamaredon Group can also inject malicious macros or remote templates into documents already present on compromised systems.2345678
All 8 groups for this technique · 6 newest in this preview
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Operation Dream JobC0022 ↗
During Operation Dream Job, Lazarus Group used DOCX files to retrieve a malicious document template/DOTM file.12
FrankensteinC0001 ↗
During Frankenstein, the threat actors used trojanized documents that retrieved remote templates from an adversary-controlled website.1
All 2 campaigns for this technique
2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
WarzoneRATS0670 ↗
Has been install via template injection through a malicious DLL embedded within a template RTF in a Word document.1
ChaesS0631 ↗
Changed the template target of the settings.xml file embedded in the Word document and populated that field with the downloaded URL of the next payload.1
All 2 software entries for this technique
Offense vs defense T1221
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 2Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 0
first rule: 2020 Q2 · 2 of 2 campaigns plottedTemplate Injection detection strategy DET0566
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Template Injection Detection - Windows
1 platform
AN1564 · Windows
Detection of Office or document viewer processes (e.g., winword.exe) initiating network connections to remote templates or executing scripts due to manipulated template references (e.g., embedded in .docx, .rtf, or .dotm files), followed by suspicious child process creation (e.g., PowerShell).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TemplateURLPatterns | Can be tuned to flag known bad domains or external resources in template fields. |
| ParentProcess | May be environment-specific; typically Word, Excel, PowerPoint. |
| TimeWindow | Correlation window for process + network activity. |
| ChildProcessAnomalyThreshold | Trigger when document-spawned child process deviates from expected profile. |
Network/Host intrusion prevention systems, antivirus, and detonation chambers can be employed to prevent documents from fetching and/or executing malicious payloads.
Consider disabling Microsoft Office macros/active content to prevent the execution of malicious payloads in documents , though this setting may not mitigate the Forced Authentication use for this technique.
Network/Host intrusion prevention systems, antivirus, and detonation chambers can be employed to prevent documents from fetching and/or executing malicious payloads.
User TrainingM1017
Train users to identify social engineering techniques and spearphishing emails that could be used to deliver malicious documents.
Tests1Executorscmd 1Need elevation0 of 1Have prerequisites0Have cleanup0Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition