Detect Office Template Macros in Splunk
Adversaries abuse Microsoft Office templates (Normal.dotm for Word, PERSONAL.XLSB for Excel) to obtain persistence. Malicious VBA macros inserted into base templates execute every time the Office application starts. Adversaries may also hijack the GlobalDotName registry key to point Word to an arbitrary template location, enabling stealth persistence that fires on every Word launch.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1137 Office Application Startup
- Sub-technique
- T1137.001 Office Template Macros
- Canonical reference
- https://attack.mitre.org/techniques/T1137/001/
SPL Detection Query
index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Security")
| eval source_type=case(
sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" AND EventCode=11, "template_write",
sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" AND EventCode=13, "registry_mod",
sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" AND EventCode=1, "process_create",
true(), "other"
)
| where source_type IN ("template_write", "registry_mod", "process_create")
| eval is_template_file=if(
source_type="template_write" AND (
match(TargetFilename, "(?i)(Normal\.dotm|PERSONAL\.XLSB|NormalEmail\.dotm)") OR
match(TargetFilename, "(?i)(\\\\AppData\\\\Roaming\\\\Microsoft\\\\(Templates|Excel\\\\XLSTART|Word\\\\STARTUP))")
) AND NOT match(Image, "(?i)(winword|excel|powerpnt|outlook|OfficeClickToRun)\.exe"),
1, 0)
| eval is_globaldotname=if(
source_type="registry_mod" AND (
match(TargetObject, "(?i)Microsoft\\\\Office.*Word.*GlobalDotName") OR
match(Details, "(?i)GlobalDotName")
), 1, 0)
| eval is_office_child=if(
source_type="process_create" AND
match(ParentImage, "(?i)(winword|excel|powerpnt)\.exe") AND
match(Image, "(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin)\.exe"),
1, 0)
| eval detection_type=case(
is_template_file=1, "Template File Modified by Non-Office Process",
is_globaldotname=1, "GlobalDotName Registry Key Modified",
is_office_child=1, "Office Application Spawned Suspicious Child Process",
true(), "unknown"
)
| where is_template_file=1 OR is_globaldotname=1 OR is_office_child=1
| eval host_user=host."|".coalesce(User, SubjectUserName, "-")
| table _time, host, User, detection_type, Image, CommandLine, TargetFilename, TargetObject, Details, ParentImage, ParentCommandLine
| sort - _timeDetects Office Template Macro persistence using Sysmon events. EventCode 11 (File Create) monitors writes to Normal.dotm, PERSONAL.XLSB, or Office startup directories from non-Office processes. EventCode 13 (Registry Value Set) catches GlobalDotName key modification in Office/Word registry paths. EventCode 1 (Process Create) catches Office applications spawning shell interpreters (cmd, PowerShell, wscript) which indicates macro execution at startup.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate IT automation tools distributing updated corporate Office templates
- User macros in Personal.xlsb for Excel task automation
- Office add-in installations writing to startup directories
- VBA IDE activity during macro development by developers or power users
Other platforms for T1137.001
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Modify Normal.dotm via PowerShell (Simulated Template Backdoor)
Expected signal: Sysmon Event ID 11: FileCreate with TargetFilename ending in Normal.dotm.bak, Image=powershell.exe. Security Event ID 4663 (if object access auditing enabled) on the template file.
- Test 2Set GlobalDotName Registry Key
Expected signal: Sysmon Event ID 13: RegistryValueSet with TargetObject containing 'Office\16.0\Word\Options\GlobalDotName' and Details='C:\Users\Public\evil.dotm'. Security Event ID 4657 (Registry value modified) if registry auditing is enabled.
- Test 3Drop File in Word STARTUP Folder
Expected signal: Sysmon Event ID 11: FileCreate with TargetFilename containing '\\Word\\STARTUP\\df00tech-test.dotm' and Image=powershell.exe.
References (7)
- https://attack.mitre.org/techniques/T1137/001/
- https://www.221bluestreet.com/post/office-templates-and-globaldotname-a-stealthy-office-persistence-technique
- https://enigma0x3.net/2014/01/23/maintaining-access-with-normal-dotm/comment-page-1/
- http://www.hexacorn.com/blog/2017/04/19/beyond-good-ol-run-key-part-62/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1137.001/T1137.001.md
- https://docs.microsoft.com/en-us/office/vba/api/overview/library-reference/library-reference-object-model
- https://github.com/nicowillis/office-macro-analysis
Unlock Pro Content
Get the full detection package for T1137.001 including response playbook, investigation guide, and atomic red team tests.