Applied Cybernetics Group
T1137 Office Application Startup
- Technique
T1137- Tactics
- Persistence
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 9
- Elastic, Splunk
- 10
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1137
MITRE description
Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins. A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: TechNet O365 Outlook Rules)
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-08-13Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them
Detection coverage
SigmaHQ community rules
- Outlook Task/Note Reminder Received (emerging-threats)
- New Outlook Macro Created (core)
- Suspicious Outlook Macro Created (core)
- Potential Persistence Via Microsoft Office Startup Folder (core)
- IE Change Domain Zone (core)
- Registry Modification to Hidden File Extension (core)
- Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting (core)
- Outlook Macro Execution Without Warning Setting Enabled (core)
- Outlook Security Settings Updated - Registry (core)
Elastic and Splunk rules
- M365 Exchange Inbox Rule with Obfuscated Name (elastic)
- M365 Exchange Inbox Phishing Evasion Rule Created (elastic)
- Outlook Home Page Registry Modification (elastic)
- Suspicious Execution via Microsoft Office Add-Ins (elastic)
- Persistence via Microsoft Office AddIns (elastic)
- Persistence via Microsoft Outlook VBA (elastic)
- Office Test Registry Persistence (elastic)
- Windows Outlook LoadMacroProviderOnBoot Persistence (splunk)
- Windows Outlook Macro Created by Suspicious Process (splunk)
- Windows Outlook Macro Security Modified (splunk)