Techniques › T1137 › T1137.002
T1137.002 Office Test
persistence — Windows, Office Suite · attack.mitre.org · JSON
1
MITRE detection strategy
2
analytics
2
Sigma rules tagged attack.t1137.002
0
KEV CVEs mapped here
<p>Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications. This Registry key is not created by default during an Office installation.</p><p>There exist user and global Registry keys for the Office Test feature, such as:</p>
- <li><code>HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf</code></li><li><code>HKEY_LOCAL_MACHINE\Software\Microsoft\Office test\Special\Perf</code></li>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0315 Detect Persistence via Office Test Registry DLL Injection v1.0
AN0880 WindowsAdversaries create the 'Office Test\Special\Perf' registry key and specify a malicious DLL path that is auto-loaded when an Office application starts. This DLL is injected into the Office process memory space and can provide persistent execution without requiring macro enablement.WinEventLog:Microsoft-Office-Alerts
Unexpected DLL or component loaded at Office startup→ DC0064 Command ExecutionTunable:RegistryPathDLLPathOfficeProcessNameTimeWindowUserContextAN0881 Office SuiteOffice application auto-loads a non-standard DLL during startup triggered via Office Test Registry key, often without macro warning banners. DLL persistence mechanism circumvents traditional macro defenses.m365:unifiedNon-standard Office startup component detected (e.g., unexpected DLL path)→ DC0016 Module LoadTunable:TrustedLocationBypassAuditPolicyScope
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1137.002
Author: omkar72
· 2020-10-25 (modified 2023-11-08) · logsource: product=windows category=registry_event · 3d27f6dd-1c74-4687-b4fa-ca849d128d1c
Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started
Author: Sohan G (D4rkCiph3r)
· 2023-01-31 (modified 2023-02-04) · logsource: product=macos category=process_creation · 69483748-1525-4a6c-95ca-90dc8d431b68
Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution
Rules tagged at the parent level (attack.t1137) 9
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Max Altgelt (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-06-02 (modified 2023-06-22) · logsource: product=windows category=file_event · 0e20c89d-2264-44ae-8238-aeeaba609ece
Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-02-08 · logsource: product=windows category=file_event · 117d3d3a-755c-4a61-b23e-9171146d094c
Detects the creation of a macro file for Outlook.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2021-04-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · 396ae3eb-4174-4b9b-880e-dc0364d78a19
Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module
Author: frack113
· 2022-01-22 (modified 2023-08-17) · logsource: product=windows category=registry_set · 45e112d0-7759-4c2a-aa36-9f8fb79d3393
Hides the file extension through modification of the registry
Author: frack113
· 2022-01-22 (modified 2023-08-17) · logsource: product=windows category=registry_set · 5df86130-4e95-4a54-90f7-26541b40aec2
Hides the file extension through modification of the registry
Author: @ScoubiMtl
· 2021-04-05 (modified 2023-02-08) · logsource: product=windows category=file_event · 8c31f563-f9a7-450c-bfa8-35f8f32f1f61
Detects the creation of a macro file for Outlook.
Author: frack113
· 2021-12-28 (modified 2026-01-09) · logsource: product=windows category=registry_set · c3cefdf4-6703-4e1c-bad8-bf422fc5015a
Detects changes to the registry values related to outlook security settings
Author: @ScoubiMtl
· 2021-04-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · e3b50fa5-3c3f-444e-937b-0a99d33731cd
Detects the modification of Outlook security setting to allow unprompted execution of macros.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-04-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · fc06e655-d98c-412f-ac76-05c2698b1cb2
Detects changes to the registry values related to outlook that indicates that a reminder was triggered for a Note or Task item. This could be a sign of exploitation of CVE-2023-23397. Further investigation is required to determine the success of an exploitation.