T1221
Template Injection
Windowsnothing on this site yetT1221 on attack.mitre.org
Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts. For example, Microsoft’s Office Open XML (OOXML) specification defines an XML-based format for Office documents (.docx, xlsx,.pptx) to replace older binary formats (.doc,.xls,.ppt).
how MITRE says to see it
Template Injection Detection - Windows
- Detection of Office or document viewer processes (e.g., winword.exe) initiating network connections to remote templates or executing scripts due to manipulated template references (e.g., embedded in.docx,.rtf, or.dotm files), followed by suspicious child process creation (e.g., PowerShell).
what reduces it
- M1031 Network Intrusion Prevention. Network/Host intrusion prevention systems, antivirus, and detonation chambers can be employed to prevent documents from fetching and/or executing malicious payloads.
- M1017 User Training. Train users to identify social engineering techniques and spearphishing emails that could be used to deliver malicious documents.
- M1049 Antivirus/Antimalware. Network/Host intrusion prevention systems, antivirus, and detonation chambers can be employed to prevent documents from fetching and/or executing malicious payloads.
- M1042 Disable or Remove Feature or Program. Consider disabling Microsoft Office macros/active content to prevent the execution of malicious payloads in documents, though this setting may not mitigate the Forced Authentication use for this technique.