Secondary Categories: 02 - Persistence

Template Files

You can overwrite or replace the existing Word or Excel Template File with a template containing malicious template.

  • %AppData%\Microsoft\Templates\Normal.dotm
  • %AppData%\Microsoft\Excel\XLSTART\Personal.xlsb

Office Add-Ins

  • Excel XLL SDK - %AppData%\Microsoft\Excel\XLSTART\Evil.XLL
  • VTSO Add-Ins
  • Office COM objects