1200KM / detection
T1137 Office Application Startup — Detection Rules
Detection workspace for T1137 Office Application Startup: 8 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- New Outlook Macro Created · test · medium · {"category":"file_event","product":"windows"}
- Suspicious Outlook Macro Created · test · high · {"category":"file_event","product":"windows"}
- Potential Persistence Via Microsoft Office Startup Folder · test · high · {"category":"file_event","product":"windows"}
- IE Change Domain Zone · test · medium · {"category":"registry_set","product":"windows"}
- Registry Modification to Hidden File Extension · test · medium · {"category":"registry_set","product":"windows"}
- Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting · test · high · {"category":"registry_set","product":"windows"}
- Outlook Macro Execution Without Warning Setting Enabled · test · high · {"category":"registry_set","product":"windows"}
- Outlook Security Settings Updated - Registry · test · medium · {"category":"registry_set","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0398 Detect Office Startup-Based Persistence via Macros, Forms, and Registry Hooks
AN1116 Analytic 1116
Office-based persistence via Office template macros, Outlook forms/rules/homepage, or registry-persistent scripts. Adversary modifies registry keys or Office application directories to load malicious scripts at startup.
AN1117 Analytic 1117
Startup-based persistence mechanisms within Microsoft Office Suite like template macros and home page redirects being configured through internal automation or client-side settings.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
- Application Log Content · DC0038
- File Creation · DC0039
- Process Creation · DC0032
- User Account Modification · DC0010
- Windows Registry Key Modification · DC0063
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.