Office Template Macros
Subtechnique · ATTACK:enterprise:T1137.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1137.001",
"title": "Office Template Macros",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1137/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--79a47ad0-fc3b-4821-9f01-a026b1ddba21",
"external_id": "T1137.001",
"domain": "enterprise",
"created": "2019-11-07T20:29:17.788Z",
"modified": "2026-05-12T15:12:00.643Z",
"version": "1.2",
"aliases": [
],
"tactics": [
"persistence"
],
"source_references": [
{
"source_name": "MSDN VBA in Office",
"url": "https://msdn.microsoft.com/en-us/vba/office-shared-vba/articles/getting-started-with-vba-in-office"
},
{
"source_name": "Hexacorn Office Template Macros",
"url": "http://www.hexacorn.com/blog/2017/04/19/beyond-good-ol-run-key-part-62/"
},
{
"source_name": "Microsoft Change Normal Template",
"url": "https://support.office.com/article/Change-the-Normal-template-Normal-dotm-06de294b-d216-47f6-ab77-ccb5166f98ea"
},
{
"source_name": "enigma0x3 normal.dotm",
"url": "https://enigma0x3.net/2014/01/23/maintaining-access-with-normal-dotm/comment-page-1/"
},
{
"source_name": "CrowdStrike Outlook Forms",
"url": "https://malware.news/t/using-outlook-forms-for-lateral-movement-and-persistence/13746"
},
{
"source_name": "GlobalDotName Jun 2019",
"url": "https://www.221bluestreet.com/post/office-templates-and-globaldotname-a-stealthy-office-persistence-technique"
},
{
"source_name": "Outlook Today Home Page",
"url": "https://medium.com/@bwtech789/outlook-today-homepage-persistence-33ea9b505943"
}
]
}Explicit source assertions (8)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1137.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--07af222c-dbd5-4ea4-b94b-a0fe8bdefcee
Reaqta MuddyWater November 2017ATTACK:enterprise:S9026 → uses → ATTACK:enterprise:T1137.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1efd302f-e162-4f68-a942-f5d14b642a78
Trend Micro Earth Kasha Anel NOV 2024ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1137.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66ce5052-08d8-4160-a8c9-f3e6b9e5cd1f
Unit 42 BackConfig May 2020ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1137.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--783be033-9c1b-4c44-a949-d120b0871d7c
win10_asrATTACK:enterprise:T1137.001 → subtechnique-of → ATTACK:enterprise:T1137
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aba9d812-3839-42c8-9759-be934c1e54a4
ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1137.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be510dc5-eae7-4231-808b-645a7b04c15a
MRWLabs Office Persistence Add-insATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1137.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c3d716d9-a94d-49a7-af66-0166d9fe1f58
ESET MirrorFace 2025ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1137.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f7232e30-bc04-476a-871a-5048a0ada06c
Talos Cobalt Strike September 2020