T1221 — Template Injection

Tactic: Stealth · Platforms: Windows

Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts. For example, Microsoft’s Office Open XML (OOXML) specification defines an XML-based format for Office documents (.docx, xlsx, .pptx) to replace older binary formats…

Sigma detection rules (1)

T1221 Template Injection

title: T1221 Template Injection
id: a0a3232f-62d7-4c35-8ffa-719fc5d3f40e
description: 'Template Injection Detection - Windows. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: TemplateURLPatterns, ParentProcess, TimeWindow, ChildProcessAnomalyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1221
author: Shahrukh Khan
date: 2026-01-10
license: MIT
tags:
  - attack.stealth
  - attack.t1221

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_office_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'

  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\mshta.exe'

  selection_remote_template_artifact:
    CommandLine|contains:
      - 'DavWWWRoot'
      - '@SSL\DavWWWRoot'
      - 'http://'
      - 'https://'

  condition: selection_office_parent and selection_child and selection_remote_template_artifact

falsepositives:
  - Legitimate automation scripts launched from Office that reference internal WebDAV shares or pass URLs as command-line arguments.

level: high

Explore