T1221No distinct observable

Template Injection

StealthWindows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

AN1564 requires two joined observables — an Office process reaching a remote template, then a suspicious child process spawned by the fetched payload — but no log source in the brief can carry the first half distinctly. An HTTP template fetch is made in-process by winword.exe/excel.exe alongside the constant licensing, roaming and template-gallery traffic every modern Office build generates, and Sysmon EventID 3 often carries no DestinationHostname to tell them apart; a template referenced by UNC path is fetched by the SMB redirector, so EventID 3 names the System process rather than the Office application and a rule keyed on the Office image there renders in every backend but matches nothing. […]

Covered instead by T1204.002, T1059.

What the technique is

Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts. For example, Microsoft’s Office Open XML (OOXML) specification defines an XML-based format for Office documents (.docx, xlsx,.pptx) to replace older binary formats (.doc,.xls,.ppt). OOXML files are packed together ZIP archives compromised of various XML files, referred to as parts, containing properties that collectively define how a document is rendered. Properties within parts may reference shared public resources accessed via online URLs. For example, template properties may reference a file, serving as a pre-formatted document blueprint, that is fetched when the document is loaded. Adversaries may abuse these templates to initially conceal malicious code to be executed via user documents. Template references injected into a document may enable malicious payloads to be fetched and executed when the document is loaded. These documents can be delivered via other techniques such as Phishing and/or Taint Shared Content and may evade static detections since no typical indicators (VBA macro, script, etc.) are present until after the malicious payload is fetched. Examples have been seen in the wild where template injection was used to load malicious code containing an exploit. […]

Read it on attack.mitre.org

What MITRE says you would watch

AN1564
Detection of Office or document viewer processes (e.g., winword.exe) initiating network connections to remote templates or executing scripts due to manipulated template references (e.g., embedded in.docx,.rtf, or.dotm files), followed by suspicious child process creation (e.g., PowerShell).