Template Injection T1221
Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts. For example, Microsoft’s Office Open XML (OOXML) specification defines an XML-based format for Office documents (.docx, xlsx,.pptx) to replace older binary formats…
- Tactics
- Stealth
- Actors using it
- 8
- Sub-techniques
- 0
Ransomware groups reported using it
Threat actors
- APT28Russia · IRON TWILIGHT, SNAKEMACKEREL, Swallowtail · 73 techniques
- Gamaredon GroupRussia · IRON TILDEN, Primitive Bear, ACTINIUM · 55 techniques
- DragonflyRussia · TEMP.Isotope, DYMALLOY, Berserk Bear · 48 techniques
- MirrorFaceChina · Earth Kasha · 37 techniques
- Tropic TrooperPirate Panda, KeyBoy · 35 techniques
- InceptionInception Framework, Cloud Atlas · 20 techniques
- ConfuciusConfucius APT · 16 techniques
- DarkHydrus7 techniques