MITRE ATT&CK T1221 Template Injection: Detecting Evasion

A document with no macro inside it can still fetch one: template injection hides the malicious part of an Office or RTF file on a remote server, so the attachment that reaches the user looks clean to static scanning. MITRE ATT&CK T1221 Template Injection sits in the Stealth tactic (TA0005) in ATT&CK v20 and applies to Windows. Adversaries create or modify template references in Office Open XML documents (.docx, .xlsx, .pptx) or the \template control word in RTF files so that, when the file opens, Office retrieves content from an attacker-controlled location. The same trick can point the template at an SMB or credential-prompting URL to trigger T1187 Forced Authentication. This guide covers how groups use the technique, what to detect and where, the four ATT&CK mitigations and the practical controls that make them work. It is for detection engineers, email and endpoint security owners and SOC analysts. This is not server-side template injection in web applications, which is a different problem covered in the Server-Side Template Injection (SSTI) Guide.

Key takeaways

• The payload is not in the file. The document carries a reference, and the dangerous content arrives only when Office resolves it, which is why attachment scanning often passes it.
• Two outcomes, one mechanism. A remote template can deliver a macro-enabled template (.dotm) or exploit, or it can point at an SMB path so Windows sends NTLM authentication to the attacker.
• The detection point is Office talking to the network. ATT&CK v20 analytic AN1564 looks for winword.exe and similar processes making outbound connections for templates, followed by unusual child processes.
• Macro blocking narrows it but does not close it. ATT&CK notes that disabling macros may not stop the Forced Authentication variant, so outbound SMB filtering matters as much as Office policy.
• Long-running and current. ATT&CK v20 links the technique to APT28, Gamaredon Group, Dragonfly, DarkHydrus, MirrorFace, Inception, Confucius and Tropic Trooper, and to Lazarus Group activity in Operation Dream Job.

How template injection works

ATT&CK describes OOXML files as ZIP archives of XML parts. Properties in those parts can reference shared resources by URL; a template property, for example, points to a pre-formatted document blueprint that Office fetches when the document loads. An adversary who writes or edits that reference can make an innocent-looking document pull a malicious template at open time. In RTF files, the legitimate \template control word names a template file to retrieve and load; adversaries alter the bytes of an existing RTF file to insert a template control word that points at a remote resource.

The attraction for the adversary is timing and separation. The first-stage file can be benign at the moment it passes the mail gateway, and the server hosting the template can choose what to serve, or serve nothing to a sandbox. For delivery context, see MITRE ATT&CK T1566 Phishing; for the credential angle, see MITRE ATT&CK T1187 Forced Authentication.

How adversaries use it: cases from ATT&CK v20

Every procedure below is a procedure example on the ATT&CK T1221 page, with the source ATT&CK cites.

Two patterns stand out. First, the technique serves both espionage groups and financially motivated malware, so it should be treated as a common delivery primitive rather than a rare tradecraft marker. Second, the Forced Authentication variant (Dragonfly, DarkHydrus) needs no code execution at all: the win for the adversary is a captured NTLM exchange that can be cracked offline or relayed. That links this technique to the NTLM work covered in the NTLM Relay Guide and the NTLM Deprecation and Elimination Guide.

What to detect and where

ATT&CK v20 maps one detection strategy, DET0566 Template Injection Detection - Windows, with one analytic, AN1564. It describes Office or document viewer processes such as winword.exe initiating network connections to remote templates, or running scripts because of a manipulated template reference in .docx, .rtf or .dotm files, followed by suspicious child processes such as PowerShell.

Building the sequence

1. Anchor on the document open: file creation by the mail client or browser (Sysmon Event ID 11) followed by an Office process start with that file in its command line.
2. Look for the fetch within seconds: a DNS query and network connection from the same Office process ID to a domain outside your template allowlist.
3. Look for consequences: a child process, a new file written to a user-writable path, or an outbound SMB attempt. Alert on the sequence; the single network event alone is noisy in organisations that use cloud-hosted templates.
4. Enrich: attach the sender, the attachment hash and the template URL to the alert so the analyst can pivot to every recipient of the same message.

Where Microsoft Defender attack surface reduction (ASR) rules are in use, the advanced hunting action types AsrOfficeChildProcessAudited and AsrOfficeChildProcessBlocked show the rule "Block all Office applications from creating child processes" firing, which often catches the second stage. See the Sysmon Guide for collecting Event IDs 1, 3, 11 and 22.

Mitigations

ATT&CK v20 lists four mitigations for T1221. The second column is the ATT&CK guidance; the third is how NHI Mgmt Group recommends making it concrete.

Office macro policy specifics

• Default behaviour: Microsoft documents that Office on Windows blocks VBA macros in files carrying Mark of the Web (zone 3 Internet or 4 Restricted sites) and shows a Security Risk banner with no Enable content button.
• Policy path: the policy is per application, for example User Configuration\Policies\Administrative Templates\Microsoft Word 2016\Word Options\Security\Trust Center, setting "Block macros from running in Office files from the Internet".
• Coverage gaps to close: Mark of the Web applies only to files on NTFS, so documents that arrive through containers or file systems that drop it lose the protection. Policies are available with Microsoft 365 Apps for enterprise.
• Alternative: "VBA Macro Notification Settings" set to disable all except digitally signed macros, with signing by a trusted publisher required.

Microsoft also documents ASR rules relevant to the second stage: "Block all Office applications from creating child processes" (d4f940ab-401b-4efc-aadc-ad5f3c50688a), "Block Office applications from creating executable content" (3b576869-a4ec-4529-8536-b80a7769e899), "Block Office applications from injecting code into other processes" (75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84) and "Block Win32 API calls from Office macros" (92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b). Run each in audit mode first, review hits for line-of-business add-ins, then move to block by pilot ring.

Rolling out controls without breaking templates

1. Inventory legitimate template sources: list the internal and cloud locations that host corporate templates, including Workgroup templates set by policy.
2. Turn on telemetry first: collect Sysmon Event IDs 1, 3 and 22 for Office processes and build the template host allowlist from two to four weeks of data.
3. Block outbound SMB: deny TCP 445 and 139 to the internet at the perimeter and on host firewalls. This is low risk and removes the Forced Authentication variant's main route.
4. Enforce macro policy: confirm "Block macros from running in Office files from the Internet" is in force across channels; pilot the signed-macros-only notification setting with finance and operations teams who use macros.
5. Enable ASR rules in audit, then block: one ring at a time, with an exclusion process that names an owner and expiry for each exception.
6. Rollback: each control is a policy setting that can be reverted per ring; keep the previous GPO or Intune profile version so a broken add-in can be restored within one policy refresh.

How to test

• Benign template fetch: in a lab, create a document whose template points at an internal web server you control that serves an empty template, then confirm the Office network event and DNS query are collected and correlated to the document open.
• SMB egress check: from a pilot workstation, confirm an outbound connection attempt to an external host on TCP 445 is blocked and logged at the firewall.
• Sandbox verdict: send the benign test document through the mail gateway and confirm the detonation report records the external template reference.
• Alert path: confirm the SOC receives the sequence alert with the sender, hash and template URL attached, and that the triage runbook covers pulling the same message from other mailboxes.

Use authorised, benign test content only; ATT&CK-based emulation plans and the published procedure examples above are enough to define realistic test cases without live payloads.

Measuring it

• Telemetry coverage: percentage of Windows endpoints sending Sysmon Event IDs 1, 3 and 22 for Office processes.
• Outbound SMB blocked: count of hosts able to reach TCP 445 on the internet (target zero).
• Macro policy compliance: percentage of devices with "Block macros from running in Office files from the Internet" applied for each Office application.
• Template allowlist drift: number of new external template hosts seen per week, each reviewed.
• Time to purge: median time from the first alert on a malicious template document to its removal from all mailboxes.

Common failure patterns

• Trusting a clean static scan: the attachment has no macro and no exploit, so it passes, and the payload arrives from the template host after delivery.
• Sandboxes without network access: detonation with networking disabled never sees the fetch and returns a benign verdict.
• Macro blocking treated as complete: the Forced Authentication variant needs no macro, so NTLM hashes still leave the network if SMB egress is open.
• Mark of the Web lost in transit: Mark of the Web applies only on NTFS, so documents that pass through other file systems lose the zone marker and the default macro block with it.
• Alerting on Office network events alone: cloud-hosted templates and add-ins create constant noise, analysts tune the rule off, and the real fetch is missed. Correlate with the document open and child process.

Framework mapping

Practitioner checklist

• Collect Sysmon Event IDs 1, 3, 11 and 22 for Office processes on all Windows endpoints.
• Build and maintain an allowlist of legitimate template hosts; alert on new external hosts contacted by Office.
• Block outbound TCP 445 and 139 to the internet at the perimeter and on host firewalls.
• Enforce "Block macros from running in Office files from the Internet" for every Office application in use.
• Run ASR Office rules in audit, review, then block by ring with owned, expiring exclusions.
• Detonate Office and RTF attachments with network access and record template targets.
• Write a correlation rule for document open, template fetch and child process, not the fetch alone.
• Add the template URL and sender to the triage runbook so all recipients can be found and purged.

Standards and references

• MITRE ATT&CK: T1221 Template Injection
• MITRE ATT&CK: T1187 Forced Authentication
• Microsoft Learn: Macros from the internet are blocked by default in Office
• Microsoft Learn: Attack surface reduction rules reference
• NIST: SP 800-53 Rev 5 Security and Privacy Controls
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: Macro Malware Guide · Office Macro Blocking Guide · MITRE ATT&CK T1566 Phishing · ATT&CK Stealth and Defense Impairment Tactics Guide · NTLM Relay Guide