Opening Forensia workspaceacquiring
Loading the current evidence view. Navigation and account controls remain available.
Loading recent evidenceacquiring
ATT&CK knowledge
Loading the current evidence view. Navigation and account controls remain available.
Tactics: persistence
2
known groups
0
software
0
corpus matches
about
Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.
A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page. These persistence mechanisms can work within Outlook or be used through Office 365.
used by actors
2 known groups
software
0 malware & tools implement this
None mapped.
corpus indicators tagged T1137
0 carry this technique
A shared-technique signal for hunting: each row resolves to its own verdict. Not attribution to any one group.
No corpus indicators are tagged with this technique yet.