Template Injection
Technique · ATTACK:enterprise:T1221
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1221",
"title": "Template Injection",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1221",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--dc31fe1e-d722-49da-8f5f-92c7b5aff534",
"external_id": "T1221",
"domain": "enterprise",
"created": "2018-10-17T00:14:20.652Z",
"modified": "2026-05-12T15:12:00.722Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"stealth"
],
"source_references": [
{
"source_name": "Talos Template Injection July 2017",
"url": "https://blog.talosintelligence.com/2017/07/template-injection.html"
},
{
"source_name": "ryhanson phishery SEPT 2016",
"url": "https://github.com/ryhanson/phishery"
},
{
"source_name": "Redxorblue Remote Template Injection",
"url": "http://blog.redxorblue.com/2018/07/executing-macros-from-docx-with-remote.html"
},
{
"source_name": "Anomali Template Injection MAR 2018",
"url": "https://forum.anomali.com/t/credential-harvesting-and-malicious-file-delivery-using-microsoft-office-template-injection/2104"
},
{
"source_name": "Microsoft Open XML July 2017",
"url": "https://docs.microsoft.com/previous-versions/office/developer/office-2007/aa338205(v=office.12)"
},
{
"source_name": "Ciberseguridad Decoding malicious RTF files",
"url": "https://ciberseguridad.blog/decodificando-ficheros-rtf-maliciosos/"
},
{
"source_name": "Proofpoint RTF Injection",
"url": "https://www.proofpoint.com/us/blog/threat-insight/injection-new-black-novel-rtf-template-inject-technique-poised-widespread"
},
{
"source_name": "MalwareBytes Template Injection OCT 2017",
"url": "https://blog.malwarebytes.com/threat-analysis/2017/10/decoy-microsoft-word-document-delivers-malware-through-rat/"
},
{
"source_name": "SANS Brian Wiltse Template Injection",
"url": "https://www.sans.org/reading-room/whitepapers/testing/template-injection-attacks-bypassing-security-controls-living-land-38780"
}
]
}Explicit source assertions (16)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1221
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2357634d-3e93-41f3-90d5-91fe4d0deb7e
Anomali Template Injection MAR 2018ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1221
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26c62507-1a2b-4235-b80c-d5f7f52d1c95
US-CERT TA18-074AATTACK:enterprise:G0142 → uses → ATTACK:enterprise:T1221
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--38467bd5-4afc-4c64-b8c0-8c7140ac9e58
Uptycs Confucius APT Jan 2021ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1221
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--55323dcc-68cb-4e92-bcf3-33c7d26f9b5e
McAfee Lazarus Jul 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1221
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--56a866fd-1a37-4750-89e6-2e26ed69cb27
Unit 42 Tropic Trooper Nov 2016ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1221
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73321011-c231-402e-a6bb-b9fd6cf6b658
Unit42 Sofacy Dec 2018ATTACK:enterprise:C0001 → uses → ATTACK:enterprise:T1221
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7457d1f4-9829-4f60-a12e-e6b9952b55f1
Talos Frankenstein June 2019ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1221
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7cabf1a6-5ad3-4c5d-83e8-161d49e082ac
ESET Gamaredon June 2020 · CERT-EE Gamaredon January 2021 · TrendMicro Gamaredon April 2020 · Microsoft Actinium February 2022 · Proofpoint RTF Injection · ESET Gamaredon Sept2024 · Secureworks IRON TILDEN Profile · Unit 42 Gamaredon February 2022ATTACK:enterprise:S0631 → uses → ATTACK:enterprise:T1221
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c22b1e4-df62-417d-a64f-c6f690ebe566
Cybereason Chaes Nov 2020ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1221
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a24399b5-218e-41b5-8904-9e8e0599ae25
Anomali Template Injection MAR 2018ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1221
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b2dac45d-0bd8-488a-a00d-d54db8d3507c
ATTACK:enterprise:G0100 → uses → ATTACK:enterprise:T1221
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c597beea-3bcd-45ee-a400-5b615f9ae621
Unit 42 Inception November 2018ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1221
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf485f42-cc2f-4ef7-9226-533192a9413c
Microsoft Disable MacrosATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1221
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d04d88d0-541d-4da2-ac58-888f1d418f20
Uptycs Confucius APT Jan 2021ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1221
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dacaf6d1-5bfa-45ff-9c6c-6c19a8bef409
ITOCHU LODEINFO JAN 2024ATTACK:enterprise:G0079 → uses → ATTACK:enterprise:T1221
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3a3186e-2ce7-4d46-836e-dc024464ede7
Unit 42 Phishery Aug 2018