Techniques › T1137.002 › AN0880
AN0880 Analytic 0880
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Adversaries create the 'Office Test\Special\Perf' registry key and specify a malicious DLL path that is auto-loaded when an Office application starts. This DLL is injected into the Office process memory space and can provide persistent execution without requiring macro enablement.</p>
- Detects
- T1137.002 Office Test
- Part of
- DET0315 Detect Persistence via Office Test Registry DLL Injection
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=13, 14 | DC0063 Windows Registry Key Modification |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Microsoft-Office-Alerts | Unexpected DLL or component loaded at Office startup | DC0064 Command Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
RegistryPath | Path to 'Office test\Special\Perf' may vary by Office version, 32/64-bit, or architecture (HKCU vs HKLM) |
DLLPath | Injected DLL may reside in different user-writable locations (e.g., %APPDATA%, %TEMP%, or network shares) |
OfficeProcessName | Process name (e.g., winword.exe, excel.exe) may vary by Office deployment and usage |
TimeWindow | Time between DLL registry creation and first Office execution may vary depending on user activity |
UserContext | Malicious DLL may target only specific users, necessitating correlation with interactive logon sessions |