Office Test registry key set to load a DLL at Office startup

Siemphony@siemphonyhighT1137.002unverified

Matches a registry value written anywhere beneath the Office Test key that AN0880 describes, `...\Microsoft\Office test\Special\Perf`, whose contents are loaded into every Office application at startup. No Office installer creates this key, so the path itself is the entire signal and no second condition is needed to make it specific. The match is a `contains` on TargetObject rather than an `endswith` on the key path, because the DLL is normally written to the *default* value of Perf and a Sysmon EventID 13 record appends the value name — `\Office test\Special\Perf\(Default)` — so an endswith anchored on `Perf` would miss precisely the deployment form the technique uses, and a trailing backslash would miss it for the same reason. Nothing to the left of `\Office test` is anchored, which is deliberate: it covers the HKCU and HKLM keys MITRE lists and the Wow6432Node redirection in one term, and Sysmon writes HKCU as HKU followed by the account SID, so a hive prefix could not be matched literally anyway. The DLL actually loading into winword.exe or excel.exe is Sysmon EventID 7 in a different log source and is not covered here. Registry monitoring in a Sysmon configuration is an explicit allowlist of paths, so confirm `Office test` is inside yours before reading an empty result as an absence of this technique. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0315, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceRegistryEvents| where RegistryKey contains "\\Office test\\Special\\Perf"

Splunk · SPL

Run this as a search.

index=* TargetObject="*\\Office test\\Special\\Perf*"

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE TO_LOWER(registry.path) LIKE "*\\\\office test\\\\special\\\\perf*"

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,registry_set,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetObject" type="pcre2">(?i)\\Office test\\Special\\Perf</field>    <description>Office Test registry key set to load a DLL at Office startup</description>    <mitre>      <id>T1137.002</id>    </mitre>  </rule></group>

At a glance

Logsource: registry_set / windows
Level: high
Category: office_macro_execution
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 6c978adf-cfef-4a00-92a3-7ddce5aced53

ATT&CKT1137.002

T1137.002Office Test

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonoffice macro execution

office macro executionAI draft — unreviewed

01 · What this rule detects

A registry value written anywhere beneath ...\Microsoft\Office test\Special\Perf. MITRE's analytic AN0880 describes an adversary creating that key and naming a DLL, which every Office application then loads into its own process at startup. The whole detection rests on one fact from the technique page: no Office installer creates this key. The artefact's mere existence is the finding, so no second condition is needed to make the rule specific.

02 · Telemetry you need

Sysmon EventID 13 (RegistryEvent, value set), mapped by the brief to the
A Sysmon config that watches this subtree. Sysmon registry monitoring is
Sysmon renders HKEY_CURRENT_USER as HKU\<account SID>, not HKCU.
The DLL loading into winword.exe is Sysmon EventID 7 (image_load) — a
translations.json records a Sentinel refusal: no table is modelled for

03 · How the logic works

The entire rule is one term:

Two decisions are worth the beginner's whole attention. `contains`, not `endswith` — because `Perf` is a key, not a value. This is the registry trap that catches people first. A registry key is a folder; a value is a named item inside it, and each key has one unnamed default value. The Office Test technique writes the DLL path into the default value of Perf, and Sysmon's TargetObject always carries key plus value name — so the record reads ...\Office test\Special\Perf\(Default). An endswith on Perf would have been a dead arm: it validates, renders in every backend, and matches the exact deployment form the technique uses zero times. A trailing backslash fails for the same reason. contains survives both the default-value and named-value forms. The reviewer verified this and called it the strongest reasoning in the batch. Nothing is anchored to the left. One term therefore covers the HKCU key, the HKLM key and the Wow6432Node redirected view that MITRE's RegistryPath knob warns vary by Office version and architecture. A hive prefix could not have been matched literally anyway, given the HKU\<SID> rendering. One backend caveat from review: the Splunk rendering is a case-sensitive comparison, so reg add "HKCU\Software\Microsoft\Office Test\..." — capital T — writes the same key, loads identically, and never matches that SPL. Wazuh uses (?i) and ES|QL lowercases both sides. The Sigma source is correct; contains is case-insensitive by specification. When your rule is a single path term, one capital letter in the wrong backend is a total bypass.

04 · Common false positives

The key's documented purpose: an Office or Microsoft support engineer loading a
Add-in, telemetry and DLP products using the same hook to get into every Office
Purple-team runs, including the Atomic Red Team test, which create and delete
Profile migration and backup-restore tooling replaying an HKCU hive that

05 · Detection maturity

tier_1: , and no higher.** UNVERIFIED — derived from MITRE ATT&CK DET0315 and never executed against a single log line.
tier_2: begins the day you confirm Office test is inside your Sysmon registry allowlist and TargetObject is populated in your pipeline.
tier_3: needs the EventID 7 correlation and the Details enrichment, neither of which this YAML can reach.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Triage on the `Details` field, which carries the DLL path. The rule cannot
MITRE's DLLPath knob is where approved vendor paths belong; the values are
Pair with EventID 7 for the DLL actually loading into an Office process — that

Declared by the author

The key's documented purpose — an Office engineer or a Microsoft support engineer loading a performance or debugging DLL into Office while reproducing a fault. This is the only genuinely benign use of the key, it is rare outside developer and support workstations, and it is indistinguishable from abuse on the registry event alone; the Details field carries the DLL path, which is what separates a supplied diagnostic from an attacker-staged binary.
Add-in, telemetry and DLP products that use the same hook to get their own code into every Office process. The write happens once at install, usually under a service account during a maintenance window, and MITRE's DLLPath knob is where the approved paths belong.
Purple-team and detection-validation runs, including the Atomic Red Team test for this technique, which create the key and remove it again a few seconds later. These arrive as a matched pair on a known test host.
Profile migration, roaming-profile and backup-restore tooling replaying an HKCU hive that already contained the key, which reproduces the original write on a new host without any new adversary action having taken place.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1137.002, evaluated against their registry_set events.

Share this rule

/u/siemphony/6c978adf-cfef-4a00-92a3-7ddce5aced53

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Office Test registry key set to load a DLL at Office startup

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it