Detecting and Mitigating the Office Test Registry Key (T1137.002)

T1137.002, Office Test, is a persistence technique that uses a registry location in Microsoft Office. It applies to Windows and Office Suite.

How attackers use it

An Office Test registry location lets a user specify an arbitrary DLL to run every time an Office application starts. MITRE says the key is thought to be used by Microsoft to load DLLs for testing and debugging while developing Office applications. It is not created by default during an Office installation.

There are user and global versions:

• HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf
• HKEY_LOCAL_MACHINE\Software\Microsoft\Office test\Special\Perf

An adversary adds the key and points it at a malicious DLL, which then runs whenever Word or Excel starts. Because the DLL loads into the Office process, macros are not involved, so macro warnings never appear. MITRE lists APT28 as a user of this technique.

How to detect it

Two signals from MITRE's analytics:

• Creation of the Office test\Special\Perf registry key with a DLL path. Sysmon event IDs 12 and 13 record registry creation and value sets.
• An Office application loading a nonstandard DLL at startup, without a macro warning banner. Sysmon event ID 7 records image loads.

The key is not there on a normal install, so alert on any creation.

How to reduce the risk

MITRE lists two steps.

1. Pre-create the key with tight permissions. Create the registry key and set its permissions to Read Control so it cannot easily be modified without administrator rights or a privilege escalation.
2. Block Office child processes and executable writes with Attack Surface Reduction rules on Windows 10.

To check your hosts, read-only:

reg query "HKCU\Software\Microsoft\Office test\Special\Perf"
reg query "HKLM\Software\Microsoft\Office test\Special\Perf"

Quick check

Sources

• MITRE ATT&CK, T1137.002 Office Test