T1137

Official Description

Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.

A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: TechNet O365 Outlook Rules)

Tactics: Persistence
Platforms: Windows, Office Suite
MITRE Version: 1.4
Last Modified: Oct 24, 2025

View on MITRE ATT&CK ↗

Sub-techniques (6)

T1137.001 · Office Template MacrosT1137.002 · Office TestT1137.003 · Outlook FormsT1137.004 · Outlook Home PageT1137.005 · Outlook RulesT1137.006 · Add-ins

Reported Context (1)

Providers advertise Office COM add-ins for persistence. Report Details How Malware Crypting Services Help Threat Actors Evade Detection

Malware (16)

Threat Actors (2)

MITRE ATT&CK (68)

Vendors (17)

Products (21)

Tools (11)

Industries (1)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.