BIOC
Informational
✕
Creation of a new Microsoft Office default template
Microsoft Office contains default templates that open whenever you start Word or Excel. Attackers may create them to establish persistence.
- Module:
- Platform Analytics
- Agent event type:
- File
- Category:
- Persistence
- Status:
- Enabled
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Office Application Startup (T1137)
Indicator:
File file path = *Roaming\Microsoft\*\Normal.dotm , *\XLSTART\*.xltm , *\XLSTART\*.xlsb AND file path != *Windows\Recent\* AND action type = create Process initiated by != winword.exe AND excel.exe AND svchost.exe AND winlogon.exe AND scanstate.exe AND userprofilemanager.exe AND xcopy.exe AND loadstate.exe AND System AND initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != Ivanti, Inc. AND VMware, Inc. AND Digital Guardian, Inc. AND Citrix Systems, Inc. AND AppSense AND Liquidware Labs, Inc. Host host os = windows
Preventable: yes