Office Test Registry Key Payload Delivery

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects the delivery of a payload containing the strings "Office Test" and "HKCU" over HTTP, indicating an attempt to modify the registry for persistence, potentially related to Office applications. The detection is based on inspecting file data within HTTP traffic flowing to the client.