Office Application Startup: Office Test
- ID
- T1137.002
- Tactics
- TA0003 Persistence
- Sub-technique of
- T1137 Office Application Startup
- Platforms
- Windows, Office Suite
- Data sources
- Windows Registry Key Modification, Process Creation, Module Load, File Creation, Command Execution
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications. This Registry key is not created by default during an Office installation.[3][2]
There exist user and global Registry keys for the Office Test feature, such as:
HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\PerfHKEY_LOCAL_MACHINE\Software\Microsoft\Office test\Special\Perf
Adversaries may add this Registry key and specify a malicious DLL that will be executed whenever an Office application, such as Word or Excel, is started.
Detection
- DET0315 Detect Persistence via Office Test Registry DLL Injection
Data components: Windows Registry Key Modification, Process Creation, Module Load, File Creation, Command Execution
Mitigations (2)
- M1040 Behavior Prevention on Endpoint
On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Office applications from creating child processes and from writing potentially malicious executable content to disk. [1]
- M1054 Software Configuration
Create the Registry key used to execute it and set the permissions to "Read Control" to prevent easy access to the key without administrator permissions or requiring Privilege Escalation.[2]