Office Application Startup: Office Test (T1137.002)

Tactic: Persistence · Platforms: Windows, Office Suite

The interactive view maps 1 detection strategy, 2 mitigations, 1 threat group to this technique, alongside D3FEND countermeasures and data-component coverage.

Sub-technique of Office Application Startup (T1137).

Overview

Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications. This Registry key is not created by default during an Office installation.

There exist user and global Registry keys for the Office Test feature, such as:

* HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf * HKEY_LOCAL_MACHINE\Software\Microsoft\Office test\Special\Perf

Adversaries may add this Registry key and specify a malicious DLL that will be executed whenever an Office application, such as Word or Excel, is started.

Explore

• Open T1137.002 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1137.002
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan