Office templates style your documents. They also load at startup. T1137.001, Office Template Macros, is the sub-technique where adversaries put code in those templates so it runs whenever the application starts. MITRE files it under persistence for Windows and Office Suite.
How attackers use it
Office base templates are used each time an application starts. Visual Basic for Applications macros can be inserted into a base template and run when that application opens. MITRE says examples for Word and Excel have been published.
The files and locations it names:
- Word.
Normal.dotmexists by default, in the Templates folder under the user's roaming profile:C:\Users\username\AppData\Roaming\Microsoft\Templates\Normal.dotm. - Excel. There is no template by default, but one can be added that loads automatically. The file is
PERSONAL.XLSBinC:\Users\username\AppData\Roaming\Microsoft\Excel\XLSTART\. - Shared templates. These can be stored on and pulled from remote locations.
An adversary can also change where the base template is read from. Two ways MITRE lists are hijacking the search order, for example Word 2016 first looks for Normal.dotm under C:\Program Files (x86)\Microsoft Office\root\Office16\, or editing the GlobalDotName registry key, which can point to an arbitrary location, file name and extension. For some of these, the adversary may need to register the template as a trusted document or put it in a trusted location, and may need to enable macros to run without restriction, depending on system settings.
The page lists BackConfig, MuddyWater and MirrorFace among users of the technique.
How to detect it
MITRE's detection covers two things:
- Macros injected into
Normal.dotmorPERSONAL.XLSB, which then run on application startup. - Redirection of the template load path through the
GlobalDotNameregistry setting, pointing Office at a remote or attacker-controlled template.
Useful telemetry: file write events on the two template paths (Sysmon event ID 11), registry value changes touching GlobalDotName (Sysmon event ID 13), and Office applications that start scripting engines or make unexpected network connections soon after they launch.
A template that changes with no user at the keyboard is a good alert. Most users never edit Normal.dotm by hand, and most never have PERSONAL.XLSB at all.
How to reduce the risk
- Disable VBA macros where you can, following Office macro security best practices for your environment. Disable Office add-ins, or require signed ones.
- Block Office child processes with Attack Surface Reduction rules on Windows 10, so Office applications cannot create child processes or write potentially malicious executable content to disk.
Check your own environment
Read-only, from a Windows command prompt for the current user:
dir "%APPDATA%\Microsoft\Templates"
dir "%APPDATA%\Microsoft\Excel\XLSTART"
Look at modified dates on Normal.dotm. A PERSONAL.XLSB that nobody can explain deserves a conversation with the user.
Check for the GlobalDotName setting under the Office registry hive for your version. Search across hives rather than guessing the version number:
reg query HKCU\Software\Microsoft\Office /s /v GlobalDotName
No output means the value is not set.
Quick check
Which registry value can redirect the base template location?
GlobalDotName.
Why does Excel need an extra step compared with Word?
Excel has no template file by default, so one has to be added, such as PERSONAL.XLSB in the XLSTART folder.
Sources
- MITRE ATT&CK, T1137.001 Office Template Macros
