Detects possible template injections in Office documents, particularly those that load content from external sources

Hunt Hypothesis

This rule detects adversaries leveraging Office document template injection (T1221) to silently fetch and execute malicious payloads from external sources, potentially bypassing standard attachment scrutiny. SOC teams should proactively hunt for this behavior in Azure Sentinel because these remote content requests often evade traditional email security controls, serving as a critical early indicator of supply chain compromises or initial access attacks that could lead to lateral movement.

YARA Rule

rule EXPL_Office_TemplateInjection_Aug19 {
   meta:
      old_rule_name = "EXPL_Office_TemplateInjection"
      description = "Detects possible template injections in Office documents, particularly those that load content from external sources"
      author = "Florian Roth"
      reference = "https://attack.mitre.org/techniques/T1221/"
      date = "2019-08-22"
      modified = "2025-03-20"
      score = 75
      hash = "f2bdf3716b39d29a9c6c3b7b3355e935594b8d8e9149a784a59dc2381fa1628a"
      id = "2a7e1021-97be-510b-8826-d15ac06ed00e"
   strings:
      $x1 = /attachedTemplate" Target="http[s]?:\/\/[^"]{4,60}/ ascii

      $fp1 = ".sharepoint.com"  // this could cause false negatives if the malicious template is hosted on sharepoint
      $fp2 = ".office.com"  // this could cause false negatives if the malicious template is hosted on office.com
   condition:
      filesize < 20MB
      and $x1
      and not 1 of ($fp*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

MITRE ATT&CK Context

• Technique: T1221 — T1221

References

• https://attack.mitre.org/techniques/T1221/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Template Injection in Office Documents” detection rule, including suggested filters and exclusions:

• Scenario: Automated Report Generation via Power BI or SSRS

  • Context: Enterprise Data Analysts use Microsoft Power BI Reports or SQL Server Reporting Services (SSRS) to generate daily PDF/Word summaries. These tools often embed Office documents that pull live charts, tables, and data visualizations from external cloud storage (e.g., OneDrive for Business or SharePoint Online) upon opening.
  • Filter/Exclusion: Create an exclusion rule based on the Process Name (PowerBIDesktop.exe, ReportServer.exe) and User Context. Exclude alerts where the initiating process is a known reporting service account (e.g., svc-reporting) or specific application executables running under the “Data Analytics” security group.

• Scenario: Scheduled Macro Execution for HR Onboarding

  • Context: The HR department utilizes a scheduled Task Scheduler job that runs nightly to process new hire forms. A master Excel template loads external employee handbooks and policy documents hosted on an internal SharePoint site via hyperlinks or embedded objects, triggering the rule during the automated run.
  • Filter/Exclusion: Implement a filter based on Scheduled Task Name (e.g., HR_Onboarding_Template_Load) and Source IP. Exclude events where the source IP belongs to the internal HR subnet (e.g., 10.20.45.0/24) and the file path matches the known template directory (\\FileServer\HR\Templates).

• Scenario: Legal Document Review with External Reference Libraries

  • Context: Legal counsel frequently opens complex Word contracts that contain embedded “Reference Tables” pulling data from an external legal database (e.g., Westlaw or LexisNexis) via O