Office Application Startup

Adversaries may abuse Microsoft Office application startup and event-triggered features to maintain persistence. MITRE ATT&CK T1137 is a parent technique covering six distinct sub-techniques: Office Template Macros, Office Test registry loading, Outlook Forms, Outlook Home Page, Outlook Rules, and Office Add-ins. These mechanisms differ in host application, trigger, and whether VBA is involved; the parent technique is not limited to COM hijacking.