A document that looks clean can still reach out and fetch something dangerous when it opens. MITRE ATT&CK tracks that as T1221, Template Injection, in the Stealth tactic. The platform is Windows.
How attackers use it
Office Open XML (OOXML) files such as .docx, .xlsx and .pptx are ZIP archives of XML parts. Properties in those parts can reference shared resources by URL. A template property, for example, can point to a file that serves as a pre-formatted blueprint and is fetched when the document loads.
MITRE says adversaries can create or modify those references to conceal malicious code or force authentication attempts. Template references injected into a document can cause a payload to be fetched and executed on load. Such documents can arrive through Phishing or Taint Shared Content. They may evade static detection because no typical indicators, such as a VBA macro or script, exist until the payload has been fetched. MITRE notes examples where template injection loaded code containing an exploit.
The same idea works in .rtf files. Adversaries may alter the template control word to point at a remote file that is retrieved and loaded when the file opens.
Why static scanning struggles
A scanner that inspects the attachment sees a document with a URL in a property. That is common in legitimate files. The harmful part sits on a server and arrives later, so what counts is the behavior of the application when the file is opened.
That is also why disabling macros may not be the full answer. MITRE points out that turning off Office macros and active content may not mitigate the Forced Authentication angle of this technique.
How to detect it
The MITRE strategy looks at Office or document viewer processes, such as winword.exe, that start network connections to remote templates or run scripts because of manipulated template references. The next signal is suspicious child process creation, such as PowerShell, from the document application.
To act on it:
- Log network connections by Office processes, for example Sysmon event ID 3, and review the destinations.
- Log process creation with parent and command line, and alert when Office applications start script hosts or shells.
- Use proxy logs to find document applications requesting template files from external hosts.
How to reduce the risk
- Use network or host intrusion prevention systems, antivirus and detonation chambers to prevent documents from fetching or executing malicious payloads.
- Train users to recognize social engineering and spearphishing emails that deliver malicious documents.
- Consider disabling Microsoft Office macros and active content, keeping in mind the Forced Authentication caveat above.
Check your own environment
- Do Office applications have unrestricted outbound access to the internet?
- Does your mail security detonate attachments, or only scan them?
- Can you alert when winword.exe starts powershell.exe or cmd.exe?
- Are macros blocked by policy for files from the internet?
Where to start
The cheapest step is policy: block macros and active content in files from the internet, and keep in mind the caveat that this does not address forced authentication. The next is network: look at which Office processes make outbound connections today, and decide whether they need unrestricted internet access. The third is detection: write one alert for Office applications that start a shell or script host. Those three steps cover the fetch, the connection and the execution.
Quick check
Why might a template injection document pass a static scan?
It contains no macro or script at delivery. The reference to a remote template looks ordinary, and the payload is fetched only after the document is opened.
Does disabling macros fully solve this?
No. MITRE notes it may not mitigate the forced authentication use of the technique.
Sources
- MITRE ATT&CK, T1221: https://attack.mitre.org/techniques/T1221
