Template Injection
Document template injection changes template relationships so ordinary document processing retrieves or activates unexpected content.
What it means
Document template injection changes template relationships so ordinary document processing retrieves or activates unexpected content. This differs from server-side template injection in web applications.
An investigation example
An Office document references a remote template not used by the sender's approved document workflow.
Evidence to examine
Inspect template references, retrieval records, authentication attempts, content versions, and application execution.
A common analytical pitfall
A remote template reference does not itself prove code execution; document the retrieval and effects separately.
Response considerations
Preserve document relationships and downloaded content, stop further exposure, and investigate authentication or execution caused by the template path.
Document processing can retrieve another component
In this ATT&CK context, template injection concerns document template relationships, not server-side template injection in a web application. A document can refer to a template or related content that the application processes. An unauthorized relationship can cause unexpected retrieval or activation of additional material when the document is handled.
The exact behavior depends on document format, application version, settings, and trust controls. A reference to an external template does not automatically prove execution or compromise. Legitimate organizations also use templates. Investigators should identify the reference, source, retrieval outcome, and subsequent process behavior.
A fictional course document
An academy receives a document that appears to be a course planning form. During a controlled investigation, analysts find an unexpected template relationship and corresponding outbound request. They preserve the document, relationship metadata, application context, and any retrieved material through an approved analysis process.
Opening the document on an ordinary workstation to inspect it can trigger behavior, so use the organization's safe document-analysis route. A static reference supports a claim about the document's configuration; network records support retrieval; execution evidence supports later activation. Keep these stages separate and do not assume every user who received the file opened it.
Distinguish the two meanings of template
Write a short comparison between a document loading a template and a web server rendering user-controlled template syntax. Identify the different software boundaries and evidence sources. Then use fictional document metadata and request events to describe a bounded finding. No malicious document needs to be created.
Defensive measures should fit actual document workflows and platform support. Restricting unnecessary external retrieval or active content can reduce some paths, but settings need testing and user guidance. Response should investigate the source and recipient scope as well as the visible reference so the team understands how the document entered the environment.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1221: Template Injection