T1137 · Office Application Startup

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1137 · Office Application Startup · Sunturai

attack-patternenterprise-attackT1137

Office Application Startup

attack-pattern--2c4d4e92-0ccf-4a97-b54c-86d662988a53

Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins. A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: TechNet O365 Outlook Rules)

Created: Dec 14, 2017, 4:46 PM UTC
Modified: Oct 24, 2025, 5:48 PM UTC

6 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

19 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Suspicious Execution via Microsoft Office Add-Ins	Medium	Elastic detection rules	Oct 8, 2026	Elastic License 2.0
Office Test Registry Persistence	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Persistence via Microsoft Outlook VBA	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Persistence via Microsoft Office AddIns	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Outlook Home Page Registry Modification	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
M365 Exchange Inbox Phishing Evasion Rule Created	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
M365 Exchange Inbox Rule with Obfuscated Name	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Outlook Security Settings Updated - Registry	Medium	SigmaHQ	Sep 4, 2026	Detection Rule License 1.1
Registry Modification to Hidden File Extension	Medium	SigmaHQ	Sep 4, 2026	Detection Rule License 1.1
Aqua Blizzard AV hits - Feb 2022	High	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Windows Outlook Macro Security Modified	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Outlook Macro Created by Suspicious Process	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Outlook LoadMacroProviderOnBoot Persistence	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Outlook Macro Execution Without Warning Setting Enabled	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
IE Change Domain Zone	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Potential Persistence Via Microsoft Office Startup Folder	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Suspicious Outlook Macro Created	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
New Outlook Macro Created	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1

Showing 19 of 19

Filter in the catalogue

External references

mitre-attackT1137Open reference

Microsoft Detect Outlook FormsOpen reference

TechNet O365 Outlook RulesOpen reference

CrowdStrike Outlook FormsOpen reference

SensePost Ruler GitHubOpen reference

SensePost NotRulerOpen reference

Outlook Today Home PageOpen reference

Platforms

Office SuiteWindows

Kill chain phases

persistence

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object