Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications. This Registry key is not created by default during an Office installation.(Citation: Hexacorn Office Test)(Citation: Palo Alto Office Test Sofacy)
There exist user and global Registry keys for the Office Test feature:
Adversaries may add this Registry key and specify a malicious DLL that will be executed whenever an Office application, such as Word or Excel, is started.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name |
|---|---|---|---|---|
| AC-10 | Concurrent Session Control | Protects | T1137.002 | Office Test |
| AC-14 | Permitted Actions Without Identification or Authentication | Protects | T1137.002 | Office Test |
| AC-17 | Remote Access | Protects | T1137.002 | Office Test |
| AC-6 | Least Privilege | Protects | T1137.002 | Office Test |
| CM-2 | Baseline Configuration | Protects | T1137.002 | Office Test |
| CM-5 | Access Restrictions for Change | Protects | T1137.002 | Office Test |
| CM-6 | Configuration Settings | Protects | T1137.002 | Office Test |
| SC-18 | Mobile Code | Protects | T1137.002 | Office Test |
| SC-44 | Detonation Chambers | Protects | T1137.002 | Office Test |
| SI-8 | Spam Protection | Protects | T1137.002 | Office Test |
| action.hacking.variety.Abuse of functionality | Abuse of functionality. | related-to | T1137.002 | Office Application Startup: Office Test |