MITRE ATT&CKtechnique
T1137 Office Application Startup
- Domain
- enterprise
- Tactics
- Persistence
- Platforms
- Windows, Office Suite
- Version
- 1.4
- Created
- 2017-12-14
Description
Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.
A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page. These persistence mechanisms can work within Outlook or be used through Office 365.
Related
Tactic · MITRE ATT&CK (1)
- TA0003 Persistence tactic
Referenced by MITRE ATT&CK · mitigates (4)
Referenced by MITRE ATT&CK · subtechnique of (6)
Referenced by Compliance · mitigates (18)
- CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution CIS Safeguard v8.1
- CIS-7.4 Perform Automated Application Patch Management CIS Safeguard v8.1
- CIS-7.7 Remediate Detected Vulnerabilities CIS Safeguard v8.1
- CIS-9.1 Ensure Use of Only Fully Supported Browsers and Email Clients CIS Safeguard v8.1
- CIS-9.4 Restrict Unnecessary or Unauthorized Browser and Email Client Extensions CIS Safeguard v8.1
- NIST-AC-10 Concurrent Session Control NIST 800-53 control
- NIST-AC-17 Remote Access NIST 800-53 control
- NIST-AC-6 Least Privilege NIST 800-53 control
- NIST-CM-2 Baseline Configuration NIST 800-53 control
- NIST-CM-6 Configuration Settings NIST 800-53 control
- NIST-CM-8 System Component Inventory NIST 800-53 control
- NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
- NIST-SC-18 Mobile Code NIST 800-53 control
- NIST-SC-44 Detonation Chambers NIST 800-53 control
- NIST-SI-2 Flaw Remediation NIST 800-53 control
- NIST-SI-3 Malicious Code Protection NIST 800-53 control
- NIST-SI-4 System Monitoring NIST 800-53 control
- NIST-SI-8 Spam Protection NIST 800-53 control
References
- https://docs.microsoft.com/en-us/office365/securitycompliance/detect-and-remediate-outlook-rules-forms-attack Microsoft Detect Outlook Forms
- https://blogs.technet.microsoft.com/office365security/defending-against-rules-and-forms-injection/ TechNet O365 Outlook Rules
- https://malware.news/t/using-outlook-forms-for-lateral-movement-and-persistence/13746 CrowdStrike Outlook Forms
- https://github.com/sensepost/ruler SensePost Ruler GitHub
- https://github.com/sensepost/notruler SensePost NotRuler
- https://medium.com/@bwtech789/outlook-today-homepage-persistence-33ea9b505943 Outlook Today Home Page