Windows Registry Persistence via Office Test Startup Key

Flags registry changes to a Windows Office test startup key that may enable auto-execution of an arbitrary DLL.

FreeUnreviewedSigmamediumv1

windows-registry-persistence-via-office-test-startup-key-3d27f6dd

title: Windows Registry Persistence via Office Test Startup Key
id: 821d303a-1b52-47bc-bc71-f1ba41da8d3b
status: test
description: This rule detects creation or modification of a specific Windows registry path associated with “Office test” startup behavior under Office. By storing an attacker-controlled reference in this location, malware can arrange for an arbitrary DLL to execute automatically when an Office application starts. The detection relies on registry event telemetry and matches the TargetObject path containing the expected subkey segment.
references:
  - https://unit42.paloaltonetworks.com/unit42-technical-walkthrough-office-test-persistence-method-used-in-recent-sofacy-attacks/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_office_test_regadd.yml
author: omkar72, Huntrule Team
date: 2020-10-25
modified: 2023-11-08
tags:
  - attack.persistence
  - attack.t1137.002
logsource:
  category: registry_event
  product: windows
detection:
  selection:
    TargetObject|contains: \Software\Microsoft\Office test\Special\Perf
  condition: selection
falsepositives:
  - Unlikely
level: medium
license: DRL-1.1
related:
  - id: 3d27f6dd-1c74-4687-b4fa-ca849d128d1c
    type: derived

What it detects

This rule detects creation or modification of a specific Windows registry path associated with “Office test” startup behavior under Office. By storing an attacker-controlled reference in this location, malware can arrange for an arbitrary DLL to execute automatically when an Office application starts. The detection relies on registry event telemetry and matches the TargetObject path containing the expected subkey segment.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.