Detect Office Template Macros in IBM QRadar
Adversaries abuse Microsoft Office templates (Normal.dotm for Word, PERSONAL.XLSB for Excel) to obtain persistence. Malicious VBA macros inserted into base templates execute every time the Office application starts. Adversaries may also hijack the GlobalDotName registry key to point Word to an arbitrary template location, enabling stealth persistence that fires on every Word launch.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1137 Office Application Startup
- Sub-technique
- T1137.001 Office Template Macros
- Canonical reference
- https://attack.mitre.org/techniques/T1137/001/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
logsourcename(logsourceid) AS log_source,
username,
"HOST"(devicehostname) AS hostname,
QIDNAME(qid) AS event_name,
"SourceFilePath" AS source_file,
"TargetFilePath" AS target_file,
"ProcessFilePath" AS process_path,
"CommandLine" AS command_line,
"RegistryKey" AS registry_key,
"RegistryValue" AS registry_value,
category,
eventdirection
FROM events
WHERE
LOGSOURCETYPEID(logsourceid) IN (12, 52, 407)
AND starttime > DATEADD('hour', -24, NOW())
AND (
-- Template file write by non-Office process (Sysmon Event 11)
(
QIDNAME(qid) LIKE '%File Created%'
AND (
LOWER("TargetFilePath") LIKE '%normal.dotm%'
OR LOWER("TargetFilePath") LIKE '%personal.xlsb%'
OR LOWER("TargetFilePath") LIKE '%normalemail.dotm%'
OR LOWER("TargetFilePath") LIKE '%appdata%roaming%microsoft%templates%'
OR LOWER("TargetFilePath") LIKE '%appdata%roaming%microsoft%excel%xlstart%'
OR LOWER("TargetFilePath") LIKE '%appdata%roaming%microsoft%word%startup%'
)
AND NOT (
LOWER("ProcessFilePath") LIKE '%winword.exe'
OR LOWER("ProcessFilePath") LIKE '%excel.exe'
OR LOWER("ProcessFilePath") LIKE '%powerpnt.exe'
OR LOWER("ProcessFilePath") LIKE '%outlook.exe'
OR LOWER("ProcessFilePath") LIKE '%officeclicktorun.exe'
)
)
OR
-- GlobalDotName registry modification (Sysmon Event 13)
(
QIDNAME(qid) LIKE '%Registry Value Set%'
AND (
LOWER("RegistryKey") LIKE '%microsoft%word%'
AND (
LOWER("RegistryValue") LIKE '%globaldotname%'
OR LOWER("RegistryKey") LIKE '%globaldotname%'
)
)
)
OR
-- Office spawning suspicious child process (Sysmon Event 1 / WinEvent 4688)
(
QIDNAME(qid) LIKE '%Process Create%'
AND (
LOWER("ParentProcessFilePath") LIKE '%winword.exe'
OR LOWER("ParentProcessFilePath") LIKE '%excel.exe'
OR LOWER("ParentProcessFilePath") LIKE '%powerpnt.exe'
)
AND (
LOWER("ProcessFilePath") LIKE '%cmd.exe'
OR LOWER("ProcessFilePath") LIKE '%powershell.exe'
OR LOWER("ProcessFilePath") LIKE '%wscript.exe'
OR LOWER("ProcessFilePath") LIKE '%cscript.exe'
OR LOWER("ProcessFilePath") LIKE '%mshta.exe'
OR LOWER("ProcessFilePath") LIKE '%rundll32.exe'
OR LOWER("ProcessFilePath") LIKE '%regsvr32.exe'
OR LOWER("ProcessFilePath") LIKE '%certutil.exe'
OR LOWER("ProcessFilePath") LIKE '%bitsadmin.exe'
)
)
)
ORDER BY starttime DESCQRadar AQL query detecting T1137.001 Office Template Macro persistence through three correlated behavioral signals sourced from Sysmon and Windows Security event logs: template file writes to known Office startup/template paths by non-Office processes, GlobalDotName registry key modification, and suspicious child process spawning from Office applications.
Data Sources
Required Tables
False Positives & Tuning
- Enterprise software deployment tools (SCCM, Intune) pushing Office template updates to managed endpoints may trigger the template file write detection
- Macro-enabled Excel Personal Macro Workbook (PERSONAL.XLSB) being legitimately created when a user first records a macro in Excel
- Legitimate use of cmd.exe or PowerShell launched from Office via DDE or legitimate automation scripts configured by the organization for business processes
Other platforms for T1137.001
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Modify Normal.dotm via PowerShell (Simulated Template Backdoor)
Expected signal: Sysmon Event ID 11: FileCreate with TargetFilename ending in Normal.dotm.bak, Image=powershell.exe. Security Event ID 4663 (if object access auditing enabled) on the template file.
- Test 2Set GlobalDotName Registry Key
Expected signal: Sysmon Event ID 13: RegistryValueSet with TargetObject containing 'Office\16.0\Word\Options\GlobalDotName' and Details='C:\Users\Public\evil.dotm'. Security Event ID 4657 (Registry value modified) if registry auditing is enabled.
- Test 3Drop File in Word STARTUP Folder
Expected signal: Sysmon Event ID 11: FileCreate with TargetFilename containing '\\Word\\STARTUP\\df00tech-test.dotm' and Image=powershell.exe.
References (7)
- https://attack.mitre.org/techniques/T1137/001/
- https://www.221bluestreet.com/post/office-templates-and-globaldotname-a-stealthy-office-persistence-technique
- https://enigma0x3.net/2014/01/23/maintaining-access-with-normal-dotm/comment-page-1/
- http://www.hexacorn.com/blog/2017/04/19/beyond-good-ol-run-key-part-62/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1137.001/T1137.001.md
- https://docs.microsoft.com/en-us/office/vba/api/overview/library-reference/library-reference-object-model
- https://github.com/nicowillis/office-macro-analysis
Unlock Pro Content
Get the full detection package for T1137.001 including response playbook, investigation guide, and atomic red team tests.