216.73.217.22

T1137: T1137

View on MITRE ATT&CK The MITRE Corporation · Published 16/12/2025 19:37 · Modified 27/04/2026 16:32

Essential information

MITRE technique ID
T1137
Confidence
100/100
Revoked
No
Published
16/12/2025 19:37
Modified
27/04/2026 16:32
Author / Source
The MITRE Corporation

Aliases

Office Application Startup

Platforms

windows Office Suite

Description

Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins. A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: TechNet O365 Outlook Rules)

Kill chain phases

Kill chainPhase
mitre-attack persistence

Marking (TLP)

TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

External references

Related entities

Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.