Técnica MITRE ATT&CK · Persistencia

`T1137.002` Office Test

Subtécnica de T1137 Office Application Startup

Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office…

Ficha en MITRE ATT&CK ↗

Quién la usa · con noticias en Jábega

APT28

Reglas Sigma para cazarla

Suspicious Microsoft Office Child Process - MacOShightest · macos
Office Application Startup - Office Testmediumtest · windows

Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.