CmdID

CmdID / Techniques / T1137

T1137.002 Office Application Startup: Office Test

Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system. MITRE ATT&CK

1 Sigma rule T1137.002 on attack.mitre.org

Part of

MITRE ATT&CK

T1137Office Application Startup

Sigma rules tagged with it

process creation, the highest levels first

highSuspicious Microsoft Office Child Process - MacOSSohan G (D4rkCiph3r) · macOS