T1137.001 — Office Template Macros

Tactic: Persistence · Platforms: Office Suite, Windows

Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts.…

Sub-technique of Office Application Startup (T1137).

Sigma detection rules (2)

T1137.001 Office Application Startup: Office Template Macros

title: "T1137.001 Office Application Startup: Office Template Macros"
id: e8d5b543-656f-4f51-8ab2-46ad592c6e64
description: 'Detect Persistence via Office Template Macro Injection or Registry Hijack. (Retargeted from the original process_creation label to file_event — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: TemplatePath, RegistryPath, TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1137/001
author: Shahrukh Khan
date: 2026-03-07
license: MIT
tags:
  - attack.persistence
  - attack.t1137.001

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    TargetFilename|endswith:
      - '.dotm'
      - '.xltm'
    TargetFilename|contains: '\Templates\'

  condition: selection

falsepositives:
  - Legitimate deployment of a custom corporate Office template via the same mechanism — verify the template's macro content and source.

level: high

T1137.001 Office Application Startup: Office Template Macros

title: "T1137.001 Office Application Startup: Office Template Macros"
id: 645aecaf-8b30-42c7-bec7-81e6825cc239
description: 'Windows Office Normal.dotm/GlobalDotName template-macro persistence has no direct Linux equivalent, and headless soffice invocation flags alone carry no malicious signal. Retargeted to the closest defensible Linux analogue: writes to LibreOffice own auto-loaded Basic macro storage and registrymodifications.xcu (which controls macro security level), a plausible persistence proxy for template-macro abuse; this remains a weak analogue, not a true equivalent. (Data Component: Command Execution; baseline tier: fallback.) Tune using: MacroSecurityLevel.'
references:
  - https://attack.mitre.org/techniques/T1137/001
author: Shahrukh Khan
date: 2026-06-18
license: MIT
tags:
  - attack.persistence
  - attack.t1137.001

logsource:
  category: file_event
  product: linux
  service: auditd

detection:
  selection:
    type: PATH
    name|contains:
      - '/.config/libreoffice/4/user/basic/'
      - '/.config/libreoffice/4/user/registrymodifications.xcu'
    nametype:
      - CREATE
      - NORMAL

  condition: selection

falsepositives:
  - Legitimate LibreOffice macro development, profile migrations, and normal macro-security setting changes touch the same files; Linux has no direct equivalent of Office template-macro persistence so this is only a weak analogue.

level: medium

Related sub-techniques

Explore