Windows Registry Persistence via Office Test Startup Key
Flags registry changes to a Windows Office test startup key that may enable auto-execution of an arbitrary DLL.
- Product
- windows
- Category
- registry_event
- Author
- omkar72 (SigmaHQ), DRL 1.1
- Published
- 2020-10-25
- Updated
- 2026-07-30
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule detects creation or modification of a specific Windows registry path associated with “Office test” startup behavior under Office. By storing an attacker-controlled reference in this location, malware can arrange for an arbitrary DLL to execute automatically when an Office application starts. The detection relies on registry event telemetry and matches the TargetObject path containing the expected subkey segment.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry Persistence via Office Test Startup Key
id: 821d303a-1b52-47bc-bc71-f1ba41da8d3b
status: test
description: This rule detects creation or modification of a specific Windows registry path associated with “Office test” startup behavior under Office. By storing an attacker-controlled reference in this location, malware can arrange for an arbitrary DLL to execute automatically when an Office application starts. The detection relies on registry event telemetry and matches the TargetObject path containing the expected subkey segment.
references:
- https://unit42.paloaltonetworks.com/unit42-technical-walkthrough-office-test-persistence-method-used-in-recent-sofacy-attacks/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_office_test_regadd.yml
author: omkar72, Huntrule Team
date: 2020-10-25
modified: 2023-11-08
tags:
- attack.persistence
- attack.t1137.002
logsource:
category: registry_event
product: windows
detection:
selection:
TargetObject|contains: \Software\Microsoft\Office test\Special\Perf
condition: selection
falsepositives:
- Unlikely
level: medium
license: DRL-1.1
related:
- id: 3d27f6dd-1c74-4687-b4fa-ca849d128d1c
type: derived