T1137 Office Application Startup
EnterpriseAdversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins. A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page. These persistence mechanisms can work within Outlook or be used through Office 365.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-techniques (6)
More specific entries beneath this one.
mitigations
ATT&CK mitigations that reduce this.
detected by (5)
Data components that detect this.
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.PSPlatform Securitymoderate · backed by 4 of 13 mapped controls
- ID.IMImprovementmoderate · backed by 3 of 13 mapped controls
- PR.AAIdentity Management, Authentication, and Access Controlmoderate · backed by 3 of 13 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (13)
Security controls that mitigate this.
groups (2)
Threat groups associated with this.
Detected by (Sigma) (9)
Sigma detection rules related to this.
source
Where this definition is published.