Threat intelligence / Technique

Office Application Startup

Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins. A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: TechNet O365 Outlook Rules)

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins. A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: TechNet O365 Outlook Rules)

12 recorded

Relationships

mitigates

from Behavior Prevention on Endpoint

Mitigation

mitigates

from Disable or Remove Feature or Program

Mitigation

mitigates

from Software Configuration

Mitigation

mitigates

from Update Software

Mitigation

subtechnique-of

Technique

subtechnique-of

from Office Template Macros

Technique

subtechnique-of

from Office Test

Technique

subtechnique-of

from Outlook Forms

Technique

subtechnique-of

from Outlook Home Page

Technique

subtechnique-of

from Outlook Rules

Technique

uses

from APT32

Group

uses

from Gamaredon Group

Group

7 external

References

mitre-attack

T1137

Microsoft Detect Outlook Forms

https://docs.microsoft.com/en-us/office365/securitycompliance/detect-and-remediate-outlook-rules-forms-attack

TechNet O365 Outlook Rules

https://blogs.technet.microsoft.com/office365security/defending-against-rules-and-forms-injection/

CrowdStrike Outlook Forms

https://malware.news/t/using-outlook-forms-for-lateral-movement-and-persistence/13746

SensePost Ruler GitHub

https://github.com/sensepost/ruler

SensePost NotRuler

https://github.com/sensepost/notruler

Outlook Today Home Page

https://medium.com/@bwtech789/outlook-today-homepage-persistence-33ea9b505943