MITRE ATT&CK technique · Persistence

`T1137.002` Office Test

Sub-technique of T1137 Office Application Startup

Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

APT28

Sigma rules to hunt it

Suspicious Microsoft Office Child Process - MacOShightest · macos
Office Application Startup - Office Testmediumtest · windows

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.