- Home
- Techniques
- Enterprise
- Office Application Startup
- Office Test
Office Application Startup: Office Test
Other sub-techniques of Office Application Startup (6)
| ID | Name |
|---|---|
| T1137.001 | Office Template Macros |
| T1137.002 | Office Test |
| T1137.003 | Outlook Forms |
| T1137.004 | Outlook Home Page |
| T1137.005 | Outlook Rules |
| T1137.006 | Add-ins |
Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications. This Registry key is not created by default during an Office installation.[1][2]
There exist user and global Registry keys for the Office Test feature:
HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\PerfHKEY_LOCAL_MACHINE\Software\Microsoft\Office test\Special\Perf
Adversaries may add this Registry key and specify a malicious DLL that will be executed whenever an Office application, such as Word or Excel, is started.
Procedure Examples
| Name | Description |
|---|---|
| APT28 |
APT28 has used the Office Test persistence mechanism within Microsoft Office by adding the Registry key |
Mitigations
| Mitigation | Description |
|---|---|
| Software Configuration |
Create the Registry key used to execute it and set the permissions to "Read Control" to prevent easy access to the key without administrator permissions or requiring Privilege Escalation.[2] |
Detection
Monitor for the creation of the Office Test Registry key. Many Office-related persistence mechanisms require changes to the Registry and for binaries, files, or scripts to be written to disk or existing files modified to include malicious scripts. Collect events related to Registry key creation and modification for keys that could be used for Office-based persistence. Since v13.52, Autoruns can detect tasks set up using the Office Test Registry key.[2]
Consider monitoring Office processes for anomalous DLL loads.