New

The executive guide to generative AI

Read more
About usPartnersSupport|Login
IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« O365 Mailbox Audit Logging Bypass Okta Brute Force or Password Spraying Attack »
Elastic Docs ›Elastic Security Solution [8.13] ›Detections and alerts ›Prebuilt rule reference

Office Test Registry Persistence

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Office Test Registry Persistence

edit

Identifies the modification of the Microsoft Office "Office Test" Registry key, a registry location that can be used to specify a DLL which will be executed every time an MS Office application is started. Attackers can abuse this to gain persistence on a compromised host.

Rule type: eql

Rule indices:

  • logs-endpoint.events.registry-*
  • logs-m365_defender.event-*
  • endgame-*
  • logs-sentinel_one_cloud_funnel.*

Severity: low

Risk score: 21

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Endpoint
  • OS: Windows
  • Use Case: Threat Detection
  • Tactic: Persistence
  • Tactic: Defense Evasion
  • Data Source: Elastic Defend
  • Data Source: Elastic Endgame
  • Data Source: Microsoft Defender for Endpoint
  • Data Source: SentinelOne

Version: 103

Rule authors:

  • Elastic

Rule license: Elastic License v2

Rule query

edit
registry where host.os.type == "windows" and event.action != "deletion" and
    registry.path : "*\\Software\\Microsoft\\Office Test\\Special\\Perf\\*"

Framework: MITRE ATT&CKTM

« O365 Mailbox Audit Logging Bypass Okta Brute Force or Password Spraying Attack »

On this page

Was this helpful?
Feedback