Office Test Registry Key for Persistence

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

Detects the addition of the 'Office test' registry key, specifically the 'Special\Perf' subkey, which allows an arbitrary DLL to be executed every time an Office application is started. This method is used for persistence.