T1137

Office Application Startup

Persistence Last updated:

Adversaries may leverage Microsoft Office-based applications for persistence between startups. Multiple mechanisms exist for Office-based persistence, including Office Template Macros, add-ins, and Outlook-specific features such as rules, forms, and Home Page. These persistence mechanisms activate when an Office application is launched or when specific Office events occur (such as receiving email), providing reliable execution on compromised endpoints. Real-world threat actors including APT32 (OceanLotus) and Gamaredon Group have abused Office persistence mechanisms, with APT32 notably replacing Outlook's VbaProject.OTM file with backdoor macros. The technique spans Word, Excel, Outlook, PowerPoint, and Access, and functions both on-premises and in Office 365 cloud environments. Sub-techniques include Office Template Macros (T1137.001), Office Test registry key (T1137.002), Outlook Forms (T1137.003), Outlook Home Page (T1137.004), Outlook Rules (T1137.005), and Add-ins (T1137.006).

What is T1137 Office Application Startup?

Office Application Startup (T1137) maps to the Persistence tactic — the adversary is trying to maintain their foothold in MITRE ATT&CK.

This page provides production-ready detection logic for Office Application Startup, covering the data sources and telemetry it touches: Process: Process Creation, Windows Registry: Windows Registry Key Modification, File: File Creation, Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Persistence
Technique
T1137 Office Application Startup
Canonical reference
https://attack.mitre.org/techniques/T1137/
Microsoft Sentinel / Defender
kusto 
let OfficeApps = dynamic(["winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "msaccess.exe", "onenote.exe"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "schtasks.exe", "net.exe", "net1.exe"]);
let OfficePersistenceExts = dynamic([".dotm", ".dotx", ".xlam", ".xla", ".xll", ".wll", ".ppam", ".ppa", ".dll"]);
// Signal 1: Office application spawning suspicious child processes (macro or add-in execution)
let OfficeChildProcess = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ (OfficeApps)
| where FileName in~ (SuspiciousChildren)
| extend Signal = "OfficeSpawnedSuspiciousProcess"
| project Timestamp, DeviceName, AccountName, Signal,
    ParentApp = InitiatingProcessFileName,
    ChildProcess = FileName,
    ProcessCommandLine,
    ParentCommandLine = InitiatingProcessCommandLine;
// Signal 2: Registry modifications to known Office persistence locations
let OfficeRegPersistence = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
| where RegistryKey has "Office test"
    or (RegistryKey has "Microsoft" and RegistryKey has "Office" and RegistryValueName startswith "OPEN")
    or RegistryKey has "WebView"
    or (RegistryKey has "Outlook" and RegistryKey has "Forms")
    or (RegistryKey has "Addins" and RegistryKey has "Microsoft" and RegistryKey has "Office")
| extend Signal = "OfficeRegistryPersistenceModified"
| project Timestamp, DeviceName,
    AccountName = InitiatingProcessAccountName, Signal,
    ParentApp = InitiatingProcessFileName,
    ChildProcess = "",
    ProcessCommandLine = strcat(RegistryKey, " -> ", coalesce(RegistryValueData, "(empty)")),
    ParentCommandLine = InitiatingProcessCommandLine;
// Signal 3: Files dropped into Office startup or add-in directories
let OfficePersistenceFiles = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where ((FolderPath has "Microsoft" and FolderPath has "Word" and FolderPath has "STARTUP")
        or (FolderPath has "Microsoft" and FolderPath has "Excel" and FolderPath has "XLSTART")
        or (FolderPath has "Microsoft" and FolderPath has "AddIns"))
        and FileName has_any (OfficePersistenceExts)
    or FileName =~ "VbaProject.OTM"
| extend Signal = "OfficePersistenceFileDropped"
| project Timestamp, DeviceName,
    AccountName = InitiatingProcessAccountName, Signal,
    ParentApp = InitiatingProcessFileName,
    ChildProcess = FileName,
    ProcessCommandLine = strcat(FolderPath, FileName),
    ParentCommandLine = InitiatingProcessCommandLine;
// Union all persistence signals
union OfficeChildProcess, OfficeRegPersistence, OfficePersistenceFiles
| sort by Timestamp desc

Detects Office Application Startup persistence via three signals: (1) Office processes spawning suspicious child processes indicating macro or add-in payload execution, (2) registry modifications to Office persistence locations including the Office Test DLL key, OPEN add-in value names, Outlook WebView Home Page URLs, Outlook Forms entries, and COM add-in registrations, and (3) files dropped into Office startup directories (Word STARTUP, Excel XLSTART, AddIns folders) or modification of the Outlook VbaProject.OTM macro project. Covers all major sub-techniques across Word, Excel, Outlook, and PowerPoint.

high severity medium confidence

Data Sources

Process: Process Creation Windows Registry: Windows Registry Key Modification File: File Creation Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents DeviceRegistryEvents DeviceFileEvents

False Positives

  • Legitimate Office add-in installation by IT administrators deploying enterprise productivity tools such as Adobe Acrobat PDF add-in, Grammarly, or Microsoft Teams Meeting add-in — these create registry entries under Addins and may drop DLL files into AddIns directories
  • Software deployment solutions (SCCM, Intune, PDQ Deploy) installing or updating Office plugins and templates during endpoint provisioning — the initiating process will be a deployment agent rather than office apps
  • Developers or power users creating custom Word STARTUP templates (.dotm) or Excel XLSTART add-ins (.xlam) for personal or departmental productivity macros — verify with the user whether the macro file was intentionally created
  • Microsoft Office application updates that modify registry keys such as add-in registrations, WebView settings, or default template associations during patching
  • Security email gateway add-ins (Proofpoint, Mimecast, Barracuda) that register as Outlook COM add-ins and create standard Addins registry entries on installation

Sigma rule & cross-platform mapping

The detection logic for Office Application Startup (T1137) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1137 Sigma rules on detection.fyi

Platform-specific guides for T1137

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-18 Research depth: deep
References (11)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Office Test Registry Key DLL Persistence (T1137.002)

    Expected signal: Sysmon Event ID 13 (RegistryValue Set): TargetObject = HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf, Details = C:\Windows\System32\calc.exe. Security Event ID 4657 (if object access auditing enabled) with ObjectName containing Office test. DeviceRegistryEvents: ActionType=RegistryValueSet, RegistryKey contains 'Office test'.

  2. Test 2Word Startup Template Drop (T1137.001)

    Expected signal: Sysmon Event ID 11 (File Create): TargetFilename = C:\Users\<user>\AppData\Roaming\Microsoft\Word\STARTUP\df00tech-test.dotm. DeviceFileEvents: ActionType=FileCreated, FolderPath contains 'Word\STARTUP', FileName=df00tech-test.dotm.

  3. Test 3Outlook Home Page URL Persistence via Registry (T1137.004)

    Expected signal: Sysmon Event ID 13 (RegistryValue Set): TargetObject contains 'Outlook\WebView\Inbox', Details = https://example.com/payload.html. DeviceRegistryEvents: ActionType=RegistryValueSet, RegistryKey has 'WebView', RegistryValueName='URL', RegistryValueData contains the external URL.

  4. Test 4Excel XLSTART Add-in Drop (T1137.006)

    Expected signal: Sysmon Event ID 11 (File Create): TargetFilename = C:\Users\<user>\AppData\Roaming\Microsoft\Excel\XLSTART\df00tech-test.xlam. DeviceFileEvents: ActionType=FileCreated, FolderPath contains 'Excel\XLSTART', FileName=df00tech-test.xlam.

  5. Test 5Outlook VbaProject.OTM Macro Project Replacement (T1137 — APT32 technique)

    Expected signal: Sysmon Event ID 11 (File Create): TargetFilename contains 'VbaProject.OTM' in the Outlook AppData directory. InitiatingProcessImage = cmd.exe (not outlook.exe). DeviceFileEvents: ActionType=FileCreated, FileName contains 'VbaProject.OTM', InitiatingProcessFileName != 'outlook.exe'.

Response Playbook

Triage

  1. Identify which Office application triggered the alert and which sub-technique is indicated: process spawn (check child process + parent command line), registry key (determine if it's Office Test DLL path, Outlook WebView URL, add-in registration, or OPEN template key), or file drop (check folder path and file extension)
  2. For registry-based signals, examine the registry value data — does it reference a local path to a DLL or executable, a remote URL (HTTP/HTTPS for Outlook Home Page), or a VBScript/macro filename? Remote URLs pointing to non-corporate domains are high confidence indicators
  3. For file-based signals, inspect the dropped file content: open the .dotm/.xlam file in a sandboxed Office instance or extract the VBA macro text using `olevba` (from python-oletools) to determine if the macro contains malicious content such as shell execution, download cradles, or registry modifications
  4. For the Office Test key (HKCU\Software\Microsoft\Office test\Special\Perf), the DLL path in the registry value is executed by Office on startup — identify whether the referenced DLL is a known-good binary (check hash against VirusTotal) or a novel dropper
  5. Identify the process that created the registry key or dropped the file — if the initiating process is an Office application itself, a script (wscript.exe, cscript.exe), or a download (from a browser or email client), this indicates the initial infection vector
  6. Check for Office application network connections following the persistence mechanism establishment using DeviceNetworkEvents where InitiatingProcessFileName in~ (OfficeApps) to identify potential C2 beaconing or second-stage payload download
  7. Review the user's recent email and document activity — Office persistence is frequently established via malicious macro-enabled attachments (.docm, .xlsm) or phishing emails with embedded Outlook forms

Containment

  1. Remove the malicious persistence mechanism before restarting Office: for registry keys use reg delete on the identified key path; for files delete the dropped .dotm/.xlam/.xll from the startup directory; for VbaProject.OTM rename or restore from backup
  2. For Outlook rules-based persistence (T1137.005), enumerate all Outlook rules using the SensePost notRuler tool or PowerShell: `Get-Mailbox | Get-InboxRule | Where-Object {$_.RuleIdentifier -ne $null}` — remove any rules that reference external executables or URLs
  3. For Outlook Home Page persistence (T1137.004), clear the WebView registry key: `reg delete "HKCU\Software\Microsoft\Office\<version>\Outlook\WebView\Inbox" /f` and disable the Outlook Home Page feature via GPO (Disable Outlook Object Model guard > Outlook Home Page)
  4. Isolate the endpoint if the malicious add-in or macro has already executed and spawned suspicious child processes — check DeviceProcessEvents for any post-execution activity (network connections, file drops, lateral movement tools)
  5. Reset the affected user's Office trust settings and clear the Trusted Locations list to prevent re-execution of malicious templates: `reg delete "HKCU\Software\Microsoft\Office\<version>\Word\Security\Trusted Locations" /f`
  6. If the VbaProject.OTM was modified (APT32 technique), restore a clean copy from backup or delete the file entirely — Outlook will recreate a clean VbaProject.OTM on next launch
  7. Block the malicious DLL hash or file path at the endpoint EDR level and add the C2 domain/IP to the network blocklist at proxy and DNS filtering layers

Evidence Collection

  1. Export the affected Office-related registry hive sections: HKCU\Software\Microsoft\Office\<version>\<App>\Options, HKCU\Software\Microsoft\Office test, HKCU\Software\Microsoft\Office\<version>\Outlook\WebView, and HKCU\Software\Microsoft\Office\<version>\<App>\Addins
  2. Collect the malicious file with its original metadata preserved (creation/modification timestamps): use `robocopy /COPYALL` or forensic acquisition tools to preserve NTFS alternate data streams and timestamps
  3. For Word/Excel macros, extract the VBA project using python-oletools: `olevba --deobf <malicious_file.dotm>` to recover the full macro source code including deobfuscated strings
  4. Sysmon Event ID 1 (Process Create) — collect all child processes spawned by Office applications in the 60-minute window surrounding the detection timestamp
  5. Sysmon Event ID 3 (Network Connection) — capture all network connections initiated by Office processes to identify C2 endpoints, download hosts, or exfiltration targets
  6. Sysmon Event ID 7 (Image Load) — collect all DLLs loaded by the affected Office application to identify the loaded malicious module and any injected libraries
  7. Sysmon Event ID 11 (File Create) — enumerate all files written by Office processes or the malicious child process to identify dropped payloads, persistence artifacts, and lateral movement tools
  8. Windows Event Log: Microsoft-Windows-OALDll/Operational and Microsoft-Office-Alerts for Office-specific execution events
  9. Outlook OST/PST file — export and analyze for malicious forms (T1137.003) using `Get-MailItem -MessageClass IPM.Note.Custom*` or MFCMAPI utility to enumerate custom form registrations

Escalation Criteria

  • ! Office Test registry key (HKCU\Software\Microsoft\Office test\Special\Perf) present — this key has no legitimate use and is exclusively used by adversaries for DLL-based persistence
  • ! Office process spawned cmd.exe or PowerShell with encoded commands, download cradles, or AMSI bypass patterns — indicates active macro execution delivering a second-stage payload
  • ! Outlook Home Page URL pointing to an external domain or IP address rather than an internal SharePoint/intranet URL — high confidence indicator of Outlook Home Page persistence (T1137.004)
  • ! VbaProject.OTM modified by a process other than outlook.exe or an Office installer — this file is only written by Outlook itself, so external modification is a strong IOC (APT32 technique)
  • ! Malicious add-in DLL loaded from a user-writable directory (AppData, Temp, Desktop) rather than Program Files — legitimate add-ins are installed in protected system paths
  • ! Multiple Office persistence mechanisms identified on the same endpoint within a short time window — indicates systematic persistence establishment by an automation framework or attacker toolkit
  • ! The malicious file or registry value hash matches known threat actor tools (cross-reference with threat intelligence feeds for Ruler tool artifacts, OceanLotus templates, or Gamaredon macro templates)

Investigation Guide

Forensic Artifacts

  • > Registry: HKCU\Software\Microsoft\Office test\Special\Perf — presence of this key with a DLL path value is exclusively malicious (T1137.002)
  • > Registry: HKCU\Software\Microsoft\Office\<version>\<App>\Options\OPEN (and OPEN1, OPEN2, etc.) — add-in or template loaded on every Office application startup
  • > Registry: HKCU\Software\Microsoft\Office\<version>\Outlook\WebView\<FolderName>\URL — Outlook Home Page URL value; legitimate values point to internal SharePoint or are absent
  • > Registry: HKCU\Software\Microsoft\Office\<version>\<App>\Addins\<ProgID> — COM add-in registration; inspect LoadBehavior value (3 = load at startup) and associated DLL path via HKCR\<ProgID>\InprocServer32
  • > File System: %APPDATA%\Microsoft\Word\STARTUP\ — Word startup templates executed on every Word launch; baseline this directory for unauthorized .dotm/.dotx files
  • > File System: %APPDATA%\Microsoft\Excel\XLSTART\ — Excel startup add-ins; unauthorized .xlam, .xla, or .xll files here are suspicious
  • > File System: %APPDATA%\Microsoft\Outlook\VbaProject.OTM — Outlook VBA project file; modification by any process other than outlook.exe is suspicious
  • > File System: %APPDATA%\Microsoft\AddIns\ — Office add-in directory; inspect for unfamiliar DLL or COM files
  • > File System: C:\Program Files\Microsoft Office\root\Office16\STARTUP\ — system-wide Office startup folder requiring admin privileges; presence of non-Microsoft files is suspicious
  • > Prefetch: %SystemRoot%\Prefetch\WINWORD.EXE-*.pf, EXCEL.EXE-*.pf, OUTLOOK.EXE-*.pf — execution timestamps and recently loaded DLL paths
  • > Windows Event Log: Microsoft-Windows-Application-Experience/Program-Telemetry — Office application startup events with loaded add-in paths
  • > Outlook Profile: %APPDATA%\Microsoft\Outlook\*.ost — OST file contains embedded Outlook forms; use MFCMAPI to enumerate custom form message classes

Tuning Guidance

Office Application Startup detections generate significant false positive volume in environments with active Office add-in management. Begin by establishing baselines: (1) enumerate all legitimate add-ins across your fleet by querying DeviceRegistryEvents for Addins registry entries and correlating with the initiating process — SCCM/Intune-pushed add-ins will show msiexec.exe or ccmexec.exe as the initiator, (2) build an allowlist of known-good add-in DLL hashes and file paths (typically under C:\Program Files\Microsoft Office\, C:\Program Files (x86)\, or C:\Program Files\Common Files\Microsoft Shared\), (3) for the Office spawning child processes signal, create exceptions for known-good Office helper processes and software integrations (e.g., PDF printers, grammar checkers, CRM plugins). The highest-fidelity signals that require no tuning are: presence of the Office Test registry key (HKCU\Software\Microsoft\Office test\Special\Perf) which has zero legitimate use, modification of VbaProject.OTM by any non-Outlook process, and Outlook WebView URLs pointing to non-corporate domains. For environments using Microsoft 365 Apps, leverage the OfficeActivity table in Microsoft Sentinel to correlate cloud-side events with endpoint-side persistence. Consider implementing Group Policy to restrict Office macros to digitally signed content from trusted publishers, which will both reduce attack surface and generate detectable policy violation events when adversaries attempt macro-based persistence.

Hunting Queries

Hunt for Office applications loading DLLs from user-writable directories (AppData, Temp, Public) — locations used by adversaries for XLL add-ins, WLL Word add-ins, and COM add-in DLLs. Filtering for DLLs seen on fewer than 3 systems helps surface novel or targeted persistence artifacts not yet in threat intel feeds.

Hunting — KQL
kql 
DeviceImageLoadEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "msaccess.exe")
| where FolderPath has_any ("\\AppData\\Roaming\\", "\\AppData\\Local\\", "\\Temp\\", "\\Users\\Public\\", "\\ProgramData\\")
| where FileName endswith ".dll" or FileName endswith ".xll" or FileName endswith ".wll"
| summarize LoadCount = count(),
    UniqueSystems = dcount(DeviceName),
    UniqueUsers = dcount(InitiatingProcessAccountName),
    FileHashes = make_set(SHA256, 5)
    by FileName, FolderPath
| where UniqueSystems < 3
| sort by LoadCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7
    (Image="*\\winword.exe" OR Image="*\\excel.exe" OR Image="*\\powerpnt.exe" OR Image="*\\outlook.exe")
    (ImageLoaded="*\\AppData\\Roaming\\*" OR ImageLoaded="*\\AppData\\Local\\*" OR ImageLoaded="*\\Temp\\*" OR ImageLoaded="*\\Users\\Public\\*")
    (ImageLoaded="*.dll" OR ImageLoaded="*.xll" OR ImageLoaded="*.wll")
| stats count as LoadCount, dc(host) as UniqueSystems, dc(User) as UniqueUsers, values(SHA256) as Hashes by ImageLoaded
| where UniqueSystems < 3
| sort - LoadCount

Hunt for Office persistence registry key modifications across all endpoints in the past 7 days. High SystemCount indicates possible mass deployment (potentially legitimate) or worm-like propagation. Low SystemCount with unusual Initiators (not msiexec.exe or Office installers) indicates targeted persistence. Values containing HTTP URLs in WebView entries or unexpected DLL paths are high-fidelity IOCs.

Hunting — KQL
kql 
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
| where RegistryKey has "Office test"
    or (RegistryKey has "Microsoft" and RegistryKey has "Office" and RegistryValueName startswith "OPEN")
    or RegistryKey has "WebView"
    or (RegistryKey has "Addins" and RegistryKey has "Microsoft" and RegistryKey has "Office")
| summarize ChangeCount = count(),
    AffectedSystems = make_set(DeviceName, 20),
    SystemCount = dcount(DeviceName),
    Initiators = make_set(InitiatingProcessFileName, 10),
    RegistryValues = make_set(RegistryValueData, 10)
    by RegistryKey, RegistryValueName
| sort by SystemCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode IN (12, 13, 14)
    (TargetObject="*Office test*"
     OR (TargetObject="*Microsoft*Office*" TargetObject="*OPEN*")
     OR TargetObject="*WebView*"
     OR (TargetObject="*Addins*" TargetObject="*Microsoft*Office*"))
| stats count as ChangeCount, dc(host) as SystemCount, values(host) as AffectedSystems, values(Image) as Initiators, values(Details) as RegistryValues by TargetObject
| sort - SystemCount

Hunt for all non-standard child processes spawned by Office applications over 7 days, excluding known legitimate helpers. This baseline-building query identifies any executable launched as a result of an Office startup macro, add-in, or Outlook rule/form/home page. High SpawnCount from a single user on a single system warrants immediate investigation as automated macro execution.

Hunting — KQL
kql 
let OfficeApps = dynamic(["winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe"]);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ (OfficeApps)
| where FileName !in~ ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe",
    "splwow64.exe", "msoia.exe", "ospp.vbs", "watson.exe", "werfault.exe",
    "dw20.exe", "officesvcmgr.exe", "msosync.exe", "onenotem.exe",
    "officeclicktorun.exe", "appvlp.exe")
| summarize SpawnCount = count(),
    UniqueCommands = dcount(ProcessCommandLine),
    ChildProcesses = make_set(FileName, 10),
    SampleCommandLines = make_set(ProcessCommandLine, 3)
    by DeviceName, AccountName, InitiatingProcessFileName
| where SpawnCount > 0
| sort by SpawnCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    (ParentImage="*\\winword.exe" OR ParentImage="*\\excel.exe" OR ParentImage="*\\powerpnt.exe" OR ParentImage="*\\outlook.exe")
    NOT (Image="*\\splwow64.exe" OR Image="*\\msoia.exe" OR Image="*\\werfault.exe" OR Image="*\\dw20.exe"
         OR Image="*\\officesvcmgr.exe" OR Image="*\\msosync.exe" OR Image="*\\officeclicktorun.exe")
| stats count as SpawnCount, dc(CommandLine) as UniqueCommands, values(Image) as ChildProcesses, values(CommandLine) as SampleCommands by host, User, ParentImage
| sort - SpawnCount

Atomic Red Team Tests

Test 1 Office Test Registry Key DLL Persistence (T1137.002)
windows

Creates the Office Test registry key (HKCU\Software\Microsoft\Office test\Special\Perf) with a DLL value pointing to calc.exe as a benign stand-in. This key causes the referenced DLL to be loaded by any Microsoft Office application on startup. The key has no legitimate purpose and its presence is an unambiguous IOC. APT32 and other threat actors use this for stealthy persistence because the key name resembles a legitimate performance monitoring entry.

Command

powershell 
reg add "HKCU\Software\Microsoft\Office test\Special\Perf" /v "" /t REG_SZ /d "C:\Windows\System32\calc.exe" /f

Cleanup

powershell 
reg delete "HKCU\Software\Microsoft\Office test\Special\Perf" /f 2>nul
reg delete "HKCU\Software\Microsoft\Office test" /f 2>nul

Expected Telemetry

Sysmon Event ID 13 (RegistryValue Set): TargetObject = HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf, Details = C:\Windows\System32\calc.exe. Security Event ID 4657 (if object access auditing enabled) with ObjectName containing Office test. DeviceRegistryEvents: ActionType=RegistryValueSet, RegistryKey contains 'Office test'.

Expected Detection

Registry persistence signal fires. KQL: RegistryKey has 'Office test'. SPL: RegPersistence=1, Signal='OfficeRegistryPersistenceModified'. This is a zero-false-positive indicator — no tuning suppression should be applied to this key.

Test 2 Word Startup Template Drop (T1137.001)
windows

Drops a file with a .dotm extension into the Word STARTUP directory, simulating the delivery of a malicious Word startup template. Any .dotm file placed in this directory is automatically loaded and its macros executed every time Microsoft Word opens. Gamaredon Group uses this technique to maintain persistent macro execution across Word sessions. The file created here is empty (benign), but the file creation event in the STARTUP directory is what triggers the detection.

Command

powershell 
copy NUL "%APPDATA%\Microsoft\Word\STARTUP\df00tech-test.dotm"

Cleanup

powershell 
del "%APPDATA%\Microsoft\Word\STARTUP\df00tech-test.dotm" 2>nul

Expected Telemetry

Sysmon Event ID 11 (File Create): TargetFilename = C:\Users\<user>\AppData\Roaming\Microsoft\Word\STARTUP\df00tech-test.dotm. DeviceFileEvents: ActionType=FileCreated, FolderPath contains 'Word\STARTUP', FileName=df00tech-test.dotm.

Expected Detection

File persistence signal fires. KQL: FolderPath has 'Word' and FolderPath has 'STARTUP', FileName ends with '.dotm'. SPL: FilePersistence=1, Signal='OfficePersistenceFileDropped'. Analyst should inspect the .dotm file content for embedded macros if it was dropped by an unexpected process.

Test 3 Outlook Home Page URL Persistence via Registry (T1137.004)
windows

Sets the Outlook Home Page URL for the Inbox folder to an external address by writing to the WebView registry key. When Outlook opens the Inbox, it renders the URL in an embedded browser pane, executing any JavaScript or ActiveX controls in the referenced HTML page. This technique was popularized by the SensePost Ruler tool and documented in the 2017 Office 365 security blog. The URL used here is a benign example domain.

Command

powershell 
reg add "HKCU\Software\Microsoft\Office\16.0\Outlook\WebView\Inbox" /v "URL" /t REG_SZ /d "https://example.com/payload.html" /f
reg add "HKCU\Software\Microsoft\Office\16.0\Outlook\WebView\Inbox" /v "Activated" /t REG_DWORD /d 1 /f

Cleanup

powershell 
reg delete "HKCU\Software\Microsoft\Office\16.0\Outlook\WebView\Inbox" /f 2>nul

Expected Telemetry

Sysmon Event ID 13 (RegistryValue Set): TargetObject contains 'Outlook\WebView\Inbox', Details = https://example.com/payload.html. DeviceRegistryEvents: ActionType=RegistryValueSet, RegistryKey has 'WebView', RegistryValueName='URL', RegistryValueData contains the external URL.

Expected Detection

Registry persistence signal fires. KQL: RegistryKey has 'WebView'. SPL: RegPersistence=1, Signal='OfficeRegistryPersistenceModified'. Analyst triage should check whether the URL points to an internal resource (SharePoint) or an external domain — external URLs are high confidence malicious.

Test 4 Excel XLSTART Add-in Drop (T1137.006)
windows

Drops a file with an .xlam extension into Excel's XLSTART directory, simulating an Excel add-in persistence mechanism. Files placed in XLSTART are automatically loaded as add-ins each time Excel opens. Real-world threat actors use .xlam files containing macro code or .xll files (Excel add-in DLLs) to achieve persistent code execution. The file created here is empty, but the file creation event in the XLSTART directory triggers the detection and would be a clear IOC for analysts.

Command

powershell 
copy NUL "%APPDATA%\Microsoft\Excel\XLSTART\df00tech-test.xlam"

Cleanup

powershell 
del "%APPDATA%\Microsoft\Excel\XLSTART\df00tech-test.xlam" 2>nul

Expected Telemetry

Sysmon Event ID 11 (File Create): TargetFilename = C:\Users\<user>\AppData\Roaming\Microsoft\Excel\XLSTART\df00tech-test.xlam. DeviceFileEvents: ActionType=FileCreated, FolderPath contains 'Excel\XLSTART', FileName=df00tech-test.xlam.

Expected Detection

File persistence signal fires. KQL: FolderPath has 'Excel' and FolderPath has 'XLSTART', FileName ends with '.xlam'. SPL: FilePersistence=1, Signal='OfficePersistenceFileDropped'. Analyst should check the initiating process — if it was not an Excel update process or known software installer, treat as malicious.

Test 5 Outlook VbaProject.OTM Macro Project Replacement (T1137 — APT32 technique)
windows

Simulates APT32's documented technique of replacing Outlook's VbaProject.OTM file to establish a persistent backdoor macro. The VbaProject.OTM file stores all Outlook VBA macros and is loaded every time Outlook starts. By replacing or overwriting this file with a malicious version containing a backdoor macro, adversaries achieve startup persistence that survives reboots. This test creates a decoy file in the correct location using cmd.exe (simulating a dropper), which is detectable because Outlook.exe itself is not the process writing the file.

Command

powershell 
echo [malicious macro placeholder] > "%APPDATA%\Microsoft\Outlook\VbaProject.OTM.bak"
copy "%APPDATA%\Microsoft\Outlook\VbaProject.OTM.bak" "%APPDATA%\Microsoft\Outlook\VbaProject.OTM.test"

Cleanup

powershell 
del "%APPDATA%\Microsoft\Outlook\VbaProject.OTM.bak" 2>nul
del "%APPDATA%\Microsoft\Outlook\VbaProject.OTM.test" 2>nul

Expected Telemetry

Sysmon Event ID 11 (File Create): TargetFilename contains 'VbaProject.OTM' in the Outlook AppData directory. InitiatingProcessImage = cmd.exe (not outlook.exe). DeviceFileEvents: ActionType=FileCreated, FileName contains 'VbaProject.OTM', InitiatingProcessFileName != 'outlook.exe'.

Expected Detection

File persistence signal fires on 'VbaProject.OTM' filename match. KQL: FileName =~ 'VbaProject.OTM'. SPL: FilePersistence=1 on 'vbaproject.otm' pattern match. High confidence IOC when initiating process is not outlook.exe — this should escalate immediately as it matches the documented APT32 persistence technique.

Related Detections

Tactic Hub

TA0003Persistence

Sub-techniques (6)

Related Techniques

T1137.001Office Template MacrosT1137.002Office TestT1137.003Outlook FormsT1137.004Outlook Home PageT1137.005Outlook RulesT1137.006Add-insT1059.005Visual BasicT1566.001Spearphishing AttachmentT1204.002Malicious FileT1105Ingress Tool TransferT1027Obfuscated Files or InformationT1053.005Scheduled TaskT1546.001Change Default File Association

Same Tactic: Persistence

Popular Detections