Office Test Registry Persistence for Malicious DLL Execution

Attackers can exploit the Microsoft Office "Office Test" Registry key (located at HKCU\Software\Microsoft\Office Test\Special\Perf) to achieve persistence. This key allows specifying a DLL that is executed whenever an MS Office application is started. By modifying this registry key to point to a malicious DLL, attackers can ensure that their code is executed every time a user opens Word, Excel, or other Office applications. This technique is particularly effective because it leverages a legitimate feature of MS Office, making it harder to detect. This activity has been observed in historical campaigns by the Sofacy APT.

Attack Chain

1. An attacker gains initial access to the target system, potentially through phishing or exploiting a software vulnerability.
2. The attacker elevates privileges to allow modification of the registry.
3. The attacker modifies the HKCU\Software\Microsoft\Office Test\Special\Perf registry key to point to a malicious DLL.
4. The malicious DLL is placed on the system in a location accessible to the user account.
5. The user launches an MS Office application (e.g., Word, Excel).
6. The MS Office application loads the malicious DLL specified in the registry key.
7. The malicious DLL executes its payload, potentially installing malware, establishing a reverse shell, or exfiltrating data.
8. The attacker maintains persistence on the system, as the malicious DLL will be loaded every time an MS Office application is launched.

Impact

Successful exploitation allows attackers to maintain persistent access to compromised systems. This can lead to data theft, installation of ransomware, or further compromise of the network. The number of victims is dependent on the scope of the initial compromise, but any system with MS Office installed is potentially vulnerable. Attackers often use this technique to maintain access to high-value targets, such as executives or system administrators.

Recommendation

• Monitor registry modifications to the HKCU\Software\Microsoft\Office Test\Special\Perf key using the Sigma rule provided to detect potential malicious activity.
• Enable Sysmon registry event logging to capture the necessary data for the Sigma rule to function correctly.
• Regularly scan systems with updated anti-malware solutions to detect and remove any malicious DLLs.
• Implement application control policies to prevent the execution of unauthorized DLLs in MS Office applications.
• Investigate any alerts generated by the Sigma rule, paying close attention to the DLL path and user activity logs.