Home/ MITRE Matrix/ Persistence/ T1137

T1137Office Application Startup

T1137 — Office Application Startup is a MITRE ATT&CK technique in the Persistence tactic. Clankerusecase tracks 3 detection use cases covering it.

Persistence

View on the matrix → Filter Detection Library MITRE official spec ↗

3Use cases

0Articles

6Sub-techniques

1Tactic

Sub-techniques (6)

T1137.006 · Add-ins T1137.001 · Office Template Macros T1137.002 · Office Test T1137.003 · Outlook Forms T1137.004 · Outlook Home Page T1137.005 · Outlook Rules

Use cases covering this technique (3)

Windows Outlook LoadMacroProviderOnBoot Persistence ESCU actions · alerting P Windows Outlook Macro Created by Suspicious Process ESCU actions · alerting P Windows Outlook Macro Security Modified ESCU actions · alerting P