Office application startup template path set in registry

Siemphony@siemphonyhighT1137.001unverified

Detects a write to the registry values that tell Word or Excel to load an extra template or startup folder every time the application launches. AN1436 names GlobalDotName, which lives as a value (not a subkey) under the Word Options key; the Excel AltStartup value is the closely related Excel equivalent and is added here, not taken from MITRE. Because a registry-set event puts the value name on the end of TargetObject, the match is an endswith on the last two path components only — the hive prefix is left out because Sysmon writes HKCU as HKU followed by the SID, and the Office version number sits between the product name and Options and differs per release. This is the template-redirect arm of the analytic only: a macro injected into an existing Normal.dotm or Personal.xlsb writes no registry value at all and is structurally invisible here, so pair this with a file-creation rule on those paths. Sysmon EventID 13 must be collected for the Office subtree — most shipped Sysmon configurations filter registry events down to a short allowlist of keys that does not include it, and a filtered key is silence rather than a clean result. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0519, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceRegistryEvents| where (RegistryKey endswith "\\Word\\Options\\GlobalDotName" or RegistryKey endswith "\\Excel\\Options\\AltStartup")

Splunk · SPL

Run this as a search.

index=* (TargetObject="*\\Word\\Options\\GlobalDotName" OR TargetObject="*\\Excel\\Options\\AltStartup")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(registry.path) LIKE "*\\\\word\\\\options\\\\globaldotname" OR TO_LOWER(registry.path) LIKE "*\\\\excel\\\\options\\\\altstartup")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,registry_set,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetObject" type="pcre2">(?i)(\\Word\\Options\\GlobalDotName$|\\Excel\\Options\\AltStartup$)</field>    <description>Office application startup template path set in registry</description>    <mitre>      <id>T1137.001</id>    </mitre>  </rule></group>

At a glance

Logsource: registry_set / windows
Level: high
Category: office_macro_execution
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 8e39163d-1e73-466f-ac1f-f0c7a3ada28c

ATT&CKT1137.001

T1137.001Office Template Macros

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonoffice macro execution

office macro executionAI draft — unreviewed

01 · What this rule detects

A registry write to the values that tell Word or Excel to load an extra template or startup folder every time the application launches. MITRE's AN1436 describes two vectors for Office Template Macros: VBA injected into an existing Normal.dotm or Personal.xlsb, or redirection of the template load path via the registry. This rule takes the registry vector only. That is the minority arm. ATT&CK's own text leads with Normal.dotm, and an adversary following the published recipe writes no registry value at all — the file route is the documented default. The description admits this and tells you to pair the rule with a file-creation rule. But note what the review adds: AN1436 offers file_event (EID 11) and create_stream_hash (EID 15) as log sources, and both go unused. The gap was a choice, not a telemetry limit. Take the general point away: a green rule against a technique ID is not coverage of that technique. Read which arm it covers before you colour a heat map.

02 · Telemetry you need

Sysmon EventID 13 (RegistryEvent — value set), via Sigma's registry_set category. Sysmon registry monitoring is an allowlist, and most shipped configurations narrow it to a short list of keys that excludes the Office subtree. A filtered key produces silence, and silence looks exactly like a clean result.
sentinel_kql is refused — no Sentinel table is modelled for registry_set/windows. Splunk, ES|QL and Wazuh all rendered.

03 · How the logic works

One selection, one field, two terms:

Every decision in those two lines is worth naming. Value, not subkey. GlobalDotName is a value inside the ...\Office\<ver>\Word\Options key, not a key of its own. Sysmon EID 13 appends the value name to the end of TargetObject, so the match must end on the value name. An endswith stopping at \Word\Options would never fire — the classic registry-rule failure, and it validates clean in every backend while matching nothing. No hive prefix. Sysmon writes HKCU as HKU\<SID>, so a path anchored at HKCU\ is dead on arrival. No version number. The Office release number sits between Office and Word (\Office\16.0\Word\Options\...). Matching only the last two components makes the rule version-agnostic — the same reason MITRE's RegistryPath knob exists, noting these keys "may differ across Office versions or deployments". Attribution. MITRE names GlobalDotName. AltStartup is Excel's equivalent and was added by the author, and the description says so. That line between derived and authored is what lets you trust the rest of the corpus. The closed two-value list misses \Word\Options\STARTUP-PATH, which redirects Word's startup folder so that every .dot/.dotm in the target directory loads at launch. Same persistence primitive, same sub-technique — and the rule's own title promises "startup template path". Adding it is one line. (Excel's OPEN/OPEN1/OPENn values are add-in auto-load and belong to T1137.006 — resist the urge to sweep them in.)

04 · Common false positives

Managed estates pointing GlobalDotName at a corporate template share by GPO
A user enabling Excel's "At startup, open all files in" option, which writes
Office deployment and add-in packaging tools provisioning these values during
The one the rule missed: settings-roaming and profile-migration tooling —

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0519 and never executed against a single log line.
tier_2: verify the Sysmon registry allowlist includes the Office subtree, run it over history, and count how much of the volume is your own GPO.
tier_3: needs the file-side rule on Normal.dotm and Personal.xlsb beside it — until that exists, the technique's default vector is untouched.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

level: high does not follow from that first false positive. The rule itself says a template-managing estate rewrites this value per host, per refresh, with no distinguishing content in the detection block. Either add a Details condition excluding the sanctioned template path — the field is named in the false-positive prose but never used in the logic — or drop to medium.
Details is where the real tuning lives: it carries the path being written, which is what separates your corporate share from an attacker-controlled UNC or WebDAV location. MITRE's RegistryPath knob is where a site records the approved value; TemplatePath is the file-side equivalent for the companion rule you still need to write.
Add STARTUP-PATH. Consider the EID 14 (registry_rename) arm the brief offers and this rule does not use — a rename-then-recreate against the Options key is invisible today.

Declared by the author

Managed estates that legitimately point GlobalDotName at a corporate template share through Group Policy, a logon script or a configuration-management baseline. This is a supported deployment mechanism, so it fires on every host in scope and again on each policy refresh that rewrites the value with unchanged data; MITRE's RegistryPath knob is where a site records the approved value, and the Details field on the event carries the path that lets you tell the sanctioned share from an attacker-controlled one.
A user turning on Excel's 'At startup, open all files in' option in the Options dialog, which writes AltStartup with no malicious intent. It is an uncommon thing for a user to do, but it is a normal supported setting, so a single hit is a question to ask rather than an incident on its own.
Office deployment, add-in packaging and template-management products that provision or repair these values during an install, a repair run or a version upgrade, typically under a service account during a maintenance window.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1137.001, evaluated against their registry_set events.

Share this rule

/u/siemphony/8e39163d-1e73-466f-ac1f-f0c7a3ada28c

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Office application startup template path set in registry

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it