Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.

A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: TechNet O365 Outlook Rules)
Office Application Startup
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1137  external_id: T1137     source_name: SensePost Ruler GitHub  description: SensePost. (2016, August 18). Ruler: A tool to abuse Exchange services. Retrieved February 4, 2019.  url: https://github.com/sensepost/ruler     source_name: TechNet O365 Outlook Rules  description: Koeller, B.. (2018, February 21). Defending Against Rules and Forms Injection. Retrieved November 5, 2019.  url: https://blogs.technet.microsoft.com/office365security/defending-against-rules-and-forms-injection/     source_name: CrowdStrike Outlook Forms  description: Parisi, T., et al. (2017, July). Using Outlook Forms for Lateral Movement and Persistence. Retrieved February 5, 2019.  url: https://malware.news/t/using-outlook-forms-for-lateral-movement-and-persistence/13746     source_name: Outlook Today Home Page  description: Soutcast. (2018, September 14). Outlook Today Homepage Persistence. Retrieved February 5, 2019.  url: https://medium.com/@bwtech789/outlook-today-homepage-persistence-33ea9b505943     source_name: Microsoft Detect Outlook Forms  description: Fox, C., Vangel, D. (2018, April 22). Detect and Remediate Outlook Rules and Custom Forms Injections Attacks in Office 365. Retrieved February 4, 2019.  url: https://docs.microsoft.com/en-us/office365/securitycompliance/detect-and-remediate-outlook-rules-forms-attack     source_name: SensePost NotRuler  description: SensePost. (2017, September 21). NotRuler - The opposite of Ruler, provides blue teams with the ability to detect Ruler usage against Exchange. Retrieved February 4, 2019.  url: https://github.com/sensepost/notruler     