---
{
  "title": "Template Injection",
  "summary": "Document template injection changes template relationships so ordinary document processing retrieves or activates unexpected content.",
  "topic": "soc",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    6
  ],
  "aliases": [
    "T1221"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1221: Template Injection",
      "url": "https://attack.mitre.org/techniques/T1221"
    }
  ],
  "editorialVersion": 2
}
---

## What it means

Document template injection changes template relationships so ordinary document processing retrieves or activates unexpected content. This differs from server-side template injection in web applications.


## An investigation example

An Office document references a remote template not used by the sender's approved document workflow.

## Evidence to examine

Inspect template references, retrieval records, authentication attempts, content versions, and application execution.

## A common analytical pitfall

A remote template reference does not itself prove code execution; document the retrieval and effects separately.

## Response considerations

Preserve document relationships and downloaded content, stop further exposure, and investigate authentication or execution caused by the template path.


## Document processing can retrieve another component

In this ATT&CK context, template injection concerns document template relationships, not server-side template injection in a web application. A document can refer to a template or related content that the application processes. An unauthorized relationship can cause unexpected retrieval or activation of additional material when the document is handled.

The exact behavior depends on document format, application version, settings, and trust controls. A reference to an external template does not automatically prove execution or compromise. Legitimate organizations also use templates. Investigators should identify the reference, source, retrieval outcome, and subsequent process behavior.

## A fictional course document

An academy receives a document that appears to be a course planning form. During a controlled investigation, analysts find an unexpected template relationship and corresponding outbound request. They preserve the document, relationship metadata, application context, and any retrieved material through an approved analysis process.

Opening the document on an ordinary workstation to inspect it can trigger behavior, so use the organization's safe document-analysis route. A static reference supports a claim about the document's configuration; network records support retrieval; execution evidence supports later activation. Keep these stages separate and do not assume every user who received the file opened it.

## Distinguish the two meanings of template

Write a short comparison between a document loading a template and a web server rendering user-controlled template syntax. Identify the different software boundaries and evidence sources. Then use fictional document metadata and request events to describe a bounded finding. No malicious document needs to be created.

Defensive measures should fit actual document workflows and platform support. Restricting unnecessary external retrieval or active content can reduce some paths, but settings need testing and user guidance. Response should investigate the source and recipient scope as well as the visible reference so the team understands how the document entered the environment.

## Related concepts

- [[mitre-attack]]
- [[logs-and-telemetry]]
- [[incident-response]]
- [[taint-shared-content]]
- [[forced-authentication]]