Cross-source coverage
T1137.002 / ATT&CK
Office Application Startup: Office Test
3 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications. This Registry key is not created by default during an Office installation.
There exist user and global Registry keys for the Office Test feature, such as:
HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\PerfHKEY_LOCAL_MACHINE\Software\Microsoft\Office test\Special\Perf
Adversaries may add this Registry key and specify a malicious DLL that will be executed whenever an Office application, such as Word or Excel, is started.
- Tactics
- Persistence
- Platforms
- Windows · Office Suite
- Telemetry
-
WinEventLog:SysmonWinEventLog:Microsoft-Office-Alertsm365:unifiedm365:office
How MITRE says to detect it DET0315
Detect Persistence via Office Test Registry DLL Injection
Windows Analytic 0880
Adversaries create the 'Office Test\Special\Perf' registry key and specify a malicious DLL path that is auto-loaded when an Office application starts. This DLL is injected into the Office process memory space and can provide persistent execution without requiring macro enablement.
WinEventLog:SysmonEventCode=13, 14WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=7WinEventLog:SysmonEventCode=11WinEventLog:Microsoft-Office-AlertsUnexpected DLL or component loaded at Office startup
Office Suite Analytic 0881
Office application auto-loads a non-standard DLL during startup triggered via Office Test Registry key, often without macro warning banners. DLL persistence mechanism circumvents traditional macro defenses.
m365:unifiedNon-standard Office startup component detected (e.g., unexpected DLL path)m365:officeStartup execution includes non-default component
SigmaHQ/sigma
2 rules| Detection | Severity | Format |
|---|---|---|
| Suspicious Microsoft Office Child Process - MacOS | High | Sigma |
| Office Application Startup - Office Test | Medium | Sigma |
elastic/detection-rules
1 rule| Detection | Severity | Format |
|---|---|---|
| Office Test Registry Persistence | Low | Elastic TOML |