T1137.002 — Office Test

Tactic: Persistence · Platforms: Windows, Office Suite

Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is…

Sub-technique of Office Application Startup (T1137).

Sigma detection rules (2)

T1137.002 Office Application Startup: Office Test

title: "T1137.002 Office Application Startup: Office Test"
id: e5d41332-18e4-4e48-8235-82c79a6db4ac
description: 'Detect persistence via Office Test registry DLL injection: TargetObject filter on Office test\Special\Perf path. (Data Component: Windows Registry Key Modification; baseline tier: windows-eventid.) Tune using: RegistryPath, DLLPath, OfficeProcessName, TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1137/002
author: Shahrukh Khan
date: 2026-01-01
license: MIT
tags:
  - attack.persistence
  - attack.t1137.002

logsource:
  category: registry_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID:
      - '12'
      - '13'
    TargetObject|contains: 'Office test\Special\Perf'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_system_account

falsepositives:
  - None commonly expected.

level: medium

T1137.002 Office Application Startup: Office Test

title: "T1137.002 Office Application Startup: Office Test"
id: 8542d21a-784a-4286-8e34-5e3497366036
description: 'The Windows "Office Test" Registry-key DLL-injection technique has no direct Linux/LibreOffice equivalent -- LibreOffice has no registry, and the previous rule substituted unrelated soffice --headless CLI flags, which its own falsepositives text admitted did not detect this technique. The closest defensible Linux analogue is LibreOffice event-to-macro autostart binding (Tools > Customize > Events, e.g. "Start Application"), which is persisted in the user profile''s registrymodifications.xcu, or a Basic macro placed in the user''s autoload "Standard" library -- both auto-execute code whenever LibreOffice starts, mirroring Office Test''s auto-exec-on-app-start behavior. If no such Linux analogue is desired, this technique should be marked not-applicable for the Linux platform rather than detected via CLI flags. Tune using: TrustedProfilePaths, KnownMacroSignatures.'
references:
  - https://attack.mitre.org/techniques/T1137/002
author: Shahrukh Khan
date: 2026-06-07
license: MIT
tags:
  - attack.persistence
  - attack.t1137.002

logsource:
  category: file_event
  product: linux
  service: auditd

detection:
  selection_registry_modification:
    type: PATH
    nametype:
      - CREATE
      - NORMAL
    name|contains: '/.config/libreoffice/'
    name|endswith: 'registrymodifications.xcu'
  selection_macro_autoload:
    type: PATH
    nametype:
      - CREATE
      - NORMAL
    name|contains: '/user/basic/Standard/'

  condition: 1 of selection_*

falsepositives:
  - Legitimate user-authored macros and customized event bindings created intentionally by power users or admins for document automation; scope KnownMacroSignatures/TrustedProfilePaths to flag only unexpected or newly-added bindings.

level: medium

Related sub-techniques

Explore