T1137

Office Application Startup

Persistence

Adversaries may leverage Microsoft Office-based applications for persistence between startups. Multiple mechanisms exist for Office-based persistence, including Office Template Macros, add-ins, and Outlook-specific features such as rules, forms, and Home Page. These persistence mechanisms activate when an Office application is launched or when specific Office events occur (such as receiving email), providing reliable execution on compromised endpoints. Real-world threat actors including APT32 (OceanLotus) and Gamaredon Group have abused Office persistence mechanisms, with APT32 notably replacing Outlook's VbaProject.OTM file with backdoor macros. The technique spans Word, Excel, Outlook, PowerPoint, and Access, and functions both on-premises and in Office 365 cloud environments. Sub-techniques include Office Template Macros (T1137.001), Office Test registry key (T1137.002), Outlook Forms (T1137.003), Outlook Home Page (T1137.004), Outlook Rules (T1137.005), and Add-ins (T1137.006).

Microsoft Sentinel / Defender
kusto 
let OfficeApps = dynamic(["winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "msaccess.exe", "onenote.exe"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "schtasks.exe", "net.exe", "net1.exe"]);
let OfficePersistenceExts = dynamic([".dotm", ".dotx", ".xlam", ".xla", ".xll", ".wll", ".ppam", ".ppa", ".dll"]);
// Signal 1: Office application spawning suspicious child processes (macro or add-in execution)
let OfficeChildProcess = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ (OfficeApps)
| where FileName in~ (SuspiciousChildren)
| extend Signal = "OfficeSpawnedSuspiciousProcess"
| project Timestamp, DeviceName, AccountName, Signal,
    ParentApp = InitiatingProcessFileName,
    ChildProcess = FileName,
    ProcessCommandLine,
    ParentCommandLine = InitiatingProcessCommandLine;
// Signal 2: Registry modifications to known Office persistence locations
let OfficeRegPersistence = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
| where RegistryKey has "Office test"
    or (RegistryKey has "Microsoft" and RegistryKey has "Office" and RegistryValueName startswith "OPEN")
    or RegistryKey has "WebView"
    or (RegistryKey has "Outlook" and RegistryKey has "Forms")
    or (RegistryKey has "Addins" and RegistryKey has "Microsoft" and RegistryKey has "Office")
| extend Signal = "OfficeRegistryPersistenceModified"
| project Timestamp, DeviceName,
    AccountName = InitiatingProcessAccountName, Signal,
    ParentApp = InitiatingProcessFileName,
    ChildProcess = "",
    ProcessCommandLine = strcat(RegistryKey, " -> ", coalesce(RegistryValueData, "(empty)")),
    ParentCommandLine = InitiatingProcessCommandLine;
// Signal 3: Files dropped into Office startup or add-in directories
let OfficePersistenceFiles = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where ((FolderPath has "Microsoft" and FolderPath has "Word" and FolderPath has "STARTUP")
        or (FolderPath has "Microsoft" and FolderPath has "Excel" and FolderPath has "XLSTART")
        or (FolderPath has "Microsoft" and FolderPath has "AddIns"))
        and FileName has_any (OfficePersistenceExts)
    or FileName =~ "VbaProject.OTM"
| extend Signal = "OfficePersistenceFileDropped"
| project Timestamp, DeviceName,
    AccountName = InitiatingProcessAccountName, Signal,
    ParentApp = InitiatingProcessFileName,
    ChildProcess = FileName,
    ProcessCommandLine = strcat(FolderPath, FileName),
    ParentCommandLine = InitiatingProcessCommandLine;
// Union all persistence signals
union OfficeChildProcess, OfficeRegPersistence, OfficePersistenceFiles
| sort by Timestamp desc
high severity medium confidence

Data Sources

Process: Process Creation Windows Registry: Windows Registry Key Modification File: File Creation Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents DeviceRegistryEvents DeviceFileEvents

False Positives

  • Legitimate Office add-in installation by IT administrators deploying enterprise productivity tools such as Adobe Acrobat PDF add-in, Grammarly, or Microsoft Teams Meeting add-in — these create registry entries under Addins and may drop DLL files into AddIns directories
  • Software deployment solutions (SCCM, Intune, PDQ Deploy) installing or updating Office plugins and templates during endpoint provisioning — the initiating process will be a deployment agent rather than office apps
  • Developers or power users creating custom Word STARTUP templates (.dotm) or Excel XLSTART add-ins (.xlam) for personal or departmental productivity macros — verify with the user whether the macro file was intentionally created
  • Microsoft Office application updates that modify registry keys such as add-in registrations, WebView settings, or default template associations during patching
  • Security email gateway add-ins (Proofpoint, Mimecast, Barracuda) that register as Outlook COM add-ins and create standard Addins registry entries on installation
Last updated: 2026-04-18 Research depth: deep
References (13)

Unlock Pro Content

Get the full detection package for T1137 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Sub-techniques (6)

Same Tactic: Persistence

Popular Detections