Detectionmediumtest
Office Application Startup - Office Test
Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsRegistry Event
ProductWindows← raw: windows
CategoryRegistry Event← raw: registry_event
Events for Windows Registry modifications including key creation, modification, and deletion.
Detection Logic
Detection Logic1 selector
detection:
selection:
TargetObject|contains: '\Software\Microsoft\Office test\Special\Perf'
condition: selectionFalse Positives
Unlikely
False positives are unlikely for most environments. High confidence detection.
MITRE ATT&CK
Tactics
Sub-techniques
Rule Metadata
Rule ID
3d27f6dd-1c74-4687-b4fa-ca849d128d1c
Status
test
Level
medium
Type
Detection
Created
Sun Oct 25
Modified
Wed Nov 08
Author
Path
rules/windows/registry/registry_event/registry_event_office_test_regadd.yml
Raw Tags
attack.persistenceattack.t1137.002