{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1221","id":"T1221","name":"Template Injection","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1221","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"baafc95ab0cd3acdd017dc38dc2b64424d9adb598b27ab9f2943b75de078e7bd","description":"Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts. For example, Microsoft’s Office Open XML (OOXML) specification defines an XML-based format for Office documents (.docx, xlsx, .pptx) to replace older binary formats (.doc, .xls, .ppt). OOXML files are packed together ZIP archives compromised of various XML files, referred to as parts, containing properties that collectively define how a document is rendered.(Citation: Microsoft Open XML July 2017)\n\nProperties within parts may reference shared public resources accessed via online URLs. For example, template properties may reference a file, serving as a pre-formatted document blueprint, that is fetched when the document is loaded.\n\nAdversaries may abuse these templates to initially conceal malicious code to be executed via user documents. Template references injected into a document may enable malicious payloads to be fetched and executed when the document is loaded.(Citation: SANS Brian Wiltse Template Injection) These documents can be delivered via other techniques such as [Phishing](https://attack.mitre.org/techniques/T1566) and/or [Taint Shared Content](https://attack.mitre.org/techniques/T1080) and may evade static detections since no typical indicators (VBA macro, script, etc.) are present until after the malicious payload is fetched.(Citation: Redxorblue Remote Template Injection) Examples have been seen in the wild where template injection was used to load malicious code containing an exploit.(Citation: MalwareBytes Template Injection OCT 2017)\n\nAdversaries may also modify the <code>*\\template</code> control word within an .rtf file to similarly conceal then download malicious code. This legitimate control word value is intended to be a file destination of a template file resource that is retrieved and loaded when an .rtf file is opened. However, adversaries may alter the bytes of an existing .rtf file to insert a template control word field to include a URL resource of a malicious payload.(Citation: Proofpoint RTF Injection)(Citation: Ciberseguridad Decoding malicious RTF files)\n\nThis technique may also enable [Forced Authentication](https://attack.mitre.org/techniques/T1187) by injecting a SMB/HTTPS (or other credential prompting) URL and triggering an authentication attempt.(Citation: Anomali Template Injection MAR 2018)(Citation: Talos Template Injection July 2017)(Citation: ryhanson phishery SEPT 2016)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1221","external_id":"T1221"},{"source_name":"Talos Template Injection July 2017","description":"Baird, S. et al.. (2017, July 7). Attack on Critical Infrastructure Leverages Template Injection. Retrieved July 21, 2018.","url":"https://blog.talosintelligence.com/2017/07/template-injection.html"},{"source_name":"ryhanson phishery SEPT 2016","description":"Hanson, R. (2016, September 24). phishery. Retrieved July 21, 2018.","url":"https://github.com/ryhanson/phishery"},{"source_name":"Redxorblue Remote Template Injection","description":"Hawkins, J. (2018, July 18). Executing Macros From a DOCX With Remote Template Injection. Retrieved October 12, 2018.","url":"http://blog.redxorblue.com/2018/07/executing-macros-from-docx-with-remote.html"},{"source_name":"Anomali Template Injection MAR 2018","description":"Intel_Acquisition_Team. (2018, March 1). Credential Harvesting and Malicious File Delivery using Microsoft Office Template Injection. Retrieved July 20, 2018.","url":"https://forum.anomali.com/t/credential-harvesting-and-malicious-file-delivery-using-microsoft-office-template-injection/2104"},{"source_name":"Microsoft Open XML July 2017","description":"Microsoft. (2014, July 9). Introducing the Office (2007) Open XML File Formats. Retrieved July 20, 2018.","url":"https://docs.microsoft.com/previous-versions/office/developer/office-2007/aa338205(v=office.12)"},{"source_name":"Ciberseguridad Decoding malicious RTF files","description":"Pedrero, R.. (2021, July). Decoding malicious RTF files. Retrieved November 16, 2021.","url":"https://ciberseguridad.blog/decodificando-ficheros-rtf-maliciosos/"},{"source_name":"Proofpoint RTF Injection","description":"Raggi, M. (2021, December 1). Injection is the New Black: Novel RTF Template Inject Technique Poised for Widespread Adoption Beyond APT Actors . Retrieved December 9, 2021.","url":"https://www.proofpoint.com/us/blog/threat-insight/injection-new-black-novel-rtf-template-inject-technique-poised-widespread"},{"source_name":"MalwareBytes Template Injection OCT 2017","description":"Segura, J. (2017, October 13). Decoy Microsoft Word document delivers malware through a RAT. Retrieved July 21, 2018.","url":"https://blog.malwarebytes.com/threat-analysis/2017/10/decoy-microsoft-word-document-delivers-malware-through-rat/"},{"source_name":"SANS Brian Wiltse Template Injection","description":"Wiltse, B.. (2018, November 7). Template Injection Attacks - Bypassing Security Controls by Living off the Land. Retrieved April 10, 2019.","url":"https://www.sans.org/reading-room/whitepapers/testing/template-injection-attacks-bypassing-security-controls-living-land-38780"}],"platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1221","id":"T1221","name":"Template Injection","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1221","technique_page":"techniques/enterprise/T1221/","page":"detections/enterprise/T1221/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[{"id":"ada3bc4f-f0fd-42b9-ba91-e105e8af7342","title":"Server Side Template Injection Strings","status":"test","level":"high","logsource":{"category":"webserver"},"data_path":"data/detection-rules/ada3bc4f-f0fd-42b9-ba91-e105e8af7342.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/webserver_generic/web_ssti_in_access_logs.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0566","name":"Template Injection Detection - Windows","url":"https://attack.mitre.org/detectionstrategies/DET0566","stix_id":"x-mitre-detection-strategy--481a55d3-5f23-4428-9438-0220eab78678","relationship_id":"relationship--efe009c7-a61c-4b9e-8ea2-f7db37de2080","description":"","analytics":[{"id":"AN1564","name":"Analytic 1564","guidance":"Detection of Office or document viewer processes (e.g., winword.exe) initiating network connections to remote templates or executing scripts due to manipulated template references (e.g., embedded in .docx, .rtf, or .dotm files), followed by suspicious child process creation (e.g., PowerShell).","url":"https://attack.mitre.org/detectionstrategies/DET0566#AN1564","platforms":["Windows"],"tuning":[{"field":"TemplateURLPatterns","description":"Can be tuned to flag known bad domains or external resources in template fields."},{"field":"ParentProcess","description":"May be environment-specific; typically Word, Excel, PowerPoint."},{"field":"TimeWindow","description":"Correlation window for process + network activity."},{"field":"ChildProcessAnomalyThreshold","description":"Trigger when document-spawned child process deviates from expected profile."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN1564","source_url":"https://attack.mitre.org/detectionstrategies/DET0566#AN1564","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN1564","source_url":"https://attack.mitre.org/detectionstrategies/DET0566#AN1564","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]}]}],"telemetry_references":[{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0631","name":"Chaes","url":"https://attack.mitre.org/software/S0631","kind":"malware","description":"[Chaes](https://attack.mitre.org/software/S0631) changed the template target of the settings.xml file embedded in the Word document and populated that field with the downloaded URL of the next payload.(Citation: Cybereason Chaes Nov 2020) ","relationship_id":"relationship--9c22b1e4-df62-417d-a64f-c6f690ebe566","references":[{"source_name":"Cybereason Chaes Nov 2020","description":"Salem, E. (2020, November 17). CHAES: Novel Malware Targeting Latin American E-Commerce. Retrieved June 30, 2021.","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf"}]},{"id":"S0670","name":"WarzoneRAT","url":"https://attack.mitre.org/software/S0670","kind":"malware","description":"[WarzoneRAT](https://attack.mitre.org/software/S0670) has been install via template injection through a malicious DLL embedded within a template RTF in a Word document.(Citation: Uptycs Confucius APT Jan 2021)","relationship_id":"relationship--d04d88d0-541d-4da2-ac58-888f1d418f20","references":[{"source_name":"Uptycs Confucius APT Jan 2021","description":"Uptycs Threat Research Team. (2021, January 12). Confucius APT deploys Warzone RAT. Retrieved December 17, 2021.","url":"https://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat"}]}],"actors":[{"id":"G0007","name":"APT28","url":"https://attack.mitre.org/groups/G0007","kind":"intrusion-set","description":"[APT28](https://attack.mitre.org/groups/G0007) used weaponized Microsoft Word documents abusing the remote template function to retrieve a malicious macro. (Citation: Unit42 Sofacy Dec 2018)","relationship_id":"relationship--73321011-c231-402e-a6bb-b9fd6cf6b658","references":[{"source_name":"Unit42 Sofacy Dec 2018","description":"Lee, B., Falcone, R. (2018, December 12). Dear Joohn: The Sofacy Group’s Global Campaign. Retrieved April 19, 2019.","url":"https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/"}]},{"id":"G0035","name":"Dragonfly","url":"https://attack.mitre.org/groups/G0035","kind":"intrusion-set","description":"[Dragonfly](https://attack.mitre.org/groups/G0035) has injected SMB URLs into malicious Word spearphishing attachments to initiate [Forced Authentication](https://attack.mitre.org/techniques/T1187).(Citation: US-CERT TA18-074A)","relationship_id":"relationship--26c62507-1a2b-4235-b80c-d5f7f52d1c95","references":[{"source_name":"US-CERT TA18-074A","description":"US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"id":"G0047","name":"Gamaredon Group","url":"https://attack.mitre.org/groups/G0047","kind":"intrusion-set","description":"[Gamaredon Group](https://attack.mitre.org/groups/G0047) has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads.(Citation: Proofpoint RTF Injection) [Gamaredon Group](https://attack.mitre.org/groups/G0047) can also inject malicious macros or remote templates into documents already present on compromised systems.(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: CERT-EE Gamaredon January 2021)(Citation: Microsoft Actinium February 2022)(Citation: Unit 42 Gamaredon February 2022)(Citation: Secureworks IRON TILDEN Profile)(Citation: ESET Gamaredon Sept2024)","relationship_id":"relationship--7cabf1a6-5ad3-4c5d-83e8-161d49e082ac","references":[{"source_name":"ESET Gamaredon June 2020","description":"Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source_name":"CERT-EE Gamaredon January 2021","description":"CERT-EE. (2021, January 27). Gamaredon Infection: From Dropper to Entry. Retrieved February 17, 2022.","url":"https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf"},{"source_name":"TrendMicro Gamaredon April 2020","description":"Kakara, H., Maruyama, E. (2020, April 17). Gamaredon APT Group Use Covid-19 Lure in Campaigns. Retrieved May 19, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/"},{"source_name":"Microsoft Actinium February 2022","description":"Microsoft Threat Intelligence Center. (2022, February 4). ACTINIUM targets Ukrainian organizations. Retrieved February 18, 2022.","url":"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"},{"source_name":"Proofpoint RTF Injection","description":"Raggi, M. (2021, December 1). Injection is the New Black: Novel RTF Template Inject Technique Poised for Widespread Adoption Beyond APT Actors . Retrieved December 9, 2021.","url":"https://www.proofpoint.com/us/blog/threat-insight/injection-new-black-novel-rtf-template-inject-technique-poised-widespread"},{"source_name":"ESET Gamaredon Sept2024","description":"Rusnák, Z. (2024, September 26). Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023. Retrieved October 30, 2024.","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source_name":"Secureworks IRON TILDEN Profile","description":"Secureworks CTU. (n.d.). IRON TILDEN. Retrieved February 24, 2022.","url":"https://www.secureworks.com/research/threat-profiles/iron-tilden"},{"source_name":"Unit 42 Gamaredon February 2022","description":"Unit 42. (2022, February 3). Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine. Retrieved February 21, 2022.","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"}]},{"id":"G0079","name":"DarkHydrus","url":"https://attack.mitre.org/groups/G0079","kind":"intrusion-set","description":"[DarkHydrus](https://attack.mitre.org/groups/G0079) used an open-source tool, Phishery, to inject malicious remote template URLs into Microsoft Word documents and then sent them to victims to enable [Forced Authentication](https://attack.mitre.org/techniques/T1187).(Citation: Unit 42 Phishery Aug 2018)","relationship_id":"relationship--e3a3186e-2ce7-4d46-836e-dc024464ede7","references":[{"source_name":"Unit 42 Phishery Aug 2018","description":"Falcone, R. (2018, August 07). DarkHydrus Uses Phishery to Harvest Credentials in the Middle East. Retrieved August 10, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-darkhydrus-uses-phishery-harvest-credentials-middle-east/"}]},{"id":"G0081","name":"Tropic Trooper","url":"https://attack.mitre.org/groups/G0081","kind":"intrusion-set","description":"[Tropic Trooper](https://attack.mitre.org/groups/G0081) delivered malicious documents with the XLSX extension, typically used by OpenXML documents, but the file itself was actually an OLE (XLS) document.(Citation: Unit 42 Tropic Trooper Nov 2016)","relationship_id":"relationship--56a866fd-1a37-4750-89e6-2e26ed69cb27","references":[{"source_name":"Unit 42 Tropic Trooper Nov 2016","description":"Ray, V. (2016, November 22). Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy. Retrieved November 9, 2018.","url":"https://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/"}]},{"id":"G0100","name":"Inception","url":"https://attack.mitre.org/groups/G0100","kind":"intrusion-set","description":"[Inception](https://attack.mitre.org/groups/G0100) has used decoy documents to load malicious remote payloads via HTTP.(Citation: Unit 42 Inception November 2018)","relationship_id":"relationship--c597beea-3bcd-45ee-a400-5b615f9ae621","references":[{"source_name":"Unit 42 Inception November 2018","description":"Lancaster, T. (2018, November 5). Inception Attackers Target Europe with Year-old Office Vulnerability. Retrieved May 8, 2020.","url":"https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/"}]},{"id":"G0142","name":"Confucius","url":"https://attack.mitre.org/groups/G0142","kind":"intrusion-set","description":"[Confucius](https://attack.mitre.org/groups/G0142) has used a weaponized Microsoft Word document with an embedded RTF exploit.(Citation: Uptycs Confucius APT Jan 2021)","relationship_id":"relationship--38467bd5-4afc-4c64-b8c0-8c7140ac9e58","references":[{"source_name":"Uptycs Confucius APT Jan 2021","description":"Uptycs Threat Research Team. (2021, January 12). Confucius APT deploys Warzone RAT. Retrieved December 17, 2021.","url":"https://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat"}]},{"id":"G1054","name":"MirrorFace","url":"https://attack.mitre.org/groups/G1054","kind":"intrusion-set","description":"[MirrorFace](https://attack.mitre.org/groups/G1054) has used remote template injection to retrieve malicious payloads from the C2.(Citation: ITOCHU LODEINFO JAN 2024)","relationship_id":"relationship--dacaf6d1-5bfa-45ff-9c6c-6c19a8bef409","references":[{"source_name":"ITOCHU LODEINFO JAN 2024","description":"ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"}]}],"mitigations":[{"id":"M1017","name":"User Training","url":"https://attack.mitre.org/mitigations/M1017","kind":"course-of-action","description":"Train users to identify social engineering techniques and spearphishing emails that could be used to deliver malicious documents.","relationship_id":"relationship--b2dac45d-0bd8-488a-a00d-d54db8d3507c","references":[]},{"id":"M1031","name":"Network Intrusion Prevention","url":"https://attack.mitre.org/mitigations/M1031","kind":"course-of-action","description":"Network/Host intrusion prevention systems, antivirus, and detonation chambers can be employed to prevent documents from fetching and/or executing malicious payloads.(Citation: Anomali Template Injection MAR 2018)","relationship_id":"relationship--a24399b5-218e-41b5-8904-9e8e0599ae25","references":[{"source_name":"Anomali Template Injection MAR 2018","description":"Intel_Acquisition_Team. (2018, March 1). Credential Harvesting and Malicious File Delivery using Microsoft Office Template Injection. Retrieved July 20, 2018.","url":"https://forum.anomali.com/t/credential-harvesting-and-malicious-file-delivery-using-microsoft-office-template-injection/2104"}]},{"id":"M1042","name":"Disable or Remove Feature or Program","url":"https://attack.mitre.org/mitigations/M1042","kind":"course-of-action","description":"Consider disabling Microsoft Office macros/active content to prevent the execution of malicious payloads in documents (Citation: Microsoft Disable Macros), though this setting may not mitigate the [Forced Authentication](https://attack.mitre.org/techniques/T1187) use for this technique.","relationship_id":"relationship--cf485f42-cc2f-4ef7-9226-533192a9413c","references":[{"source_name":"Microsoft Disable Macros","description":"Microsoft. (n.d.). Enable or disable macros in Office files. Retrieved September 13, 2018.","url":"https://support.office.com/article/enable-or-disable-macros-in-office-files-12b036fd-d140-4e74-b45e-16fed1a7e5c6"}]},{"id":"M1049","name":"Antivirus/Antimalware","url":"https://attack.mitre.org/mitigations/M1049","kind":"course-of-action","description":"Network/Host intrusion prevention systems, antivirus, and detonation chambers can be employed to prevent documents from fetching and/or executing malicious payloads.(Citation: Anomali Template Injection MAR 2018)","relationship_id":"relationship--2357634d-3e93-41f3-90d5-91fe4d0deb7e","references":[{"source_name":"Anomali Template Injection MAR 2018","description":"Intel_Acquisition_Team. (2018, March 1). Credential Harvesting and Malicious File Delivery using Microsoft Office Template Injection. Retrieved July 20, 2018.","url":"https://forum.anomali.com/t/credential-harvesting-and-malicious-file-delivery-using-microsoft-office-template-injection/2104"}]}],"candidates":[{"id":"1489e08a-82c7-44ee-b769-51b72d03521d","name":"WINWORD Remote Template Injection","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1221/T1221.yaml","description":"Open a .docx file that loads a remote .dotm macro enabled template from https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1221/src/opencalc.dotm \nExecutes the code specified within the .dotm template.\nRequires download of WINWORD found in Microsoft Ofiice at Microsoft: https://www.microsoft.com/en-us/download/office.aspx.  \nDefault docs file opens Calculator.exe when test sucessfully executed, while AV turned off.\n","inputs":{"docx_file":{"description":"Location of the test docx file on the local filesystem.","type":"path","default":"PathToAtomicsFolder\\T1221\\src\\Calculator.docx"}},"dependencies":[],"source_definition_sha256":"daeefe039d8c2e4f1303c14838dbbd872cca18d73ac737d5fc214560f825b1a2"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1566":"/ttp-simulation/techniques/enterprise/T1566/","T1080":"/ttp-simulation/techniques/enterprise/T1080/","T1187":"/ttp-simulation/techniques/enterprise/T1187/","T1221":"/ttp-simulation/techniques/enterprise/T1221/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1221","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}