Microsoft Office adds a value to autostart Registry key

Analytics BIOC Low

Microsoft Office adds a value to autostart Registry key

Microsoft Office adds a value to a registry entry (run keys, startup folders) to establish persistence.

Module:: Platform Analytics
Data source:: XDR Agent with eXtended Threat Hunting (XTH)

ATT&CK tactics: Persistence (TA0003)

ATT&CK techniques: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)

Attacker's goals:

Gain persistence on the host using the Window's autostart Mechanism.

Investigative actions:

Check the registry key and determine what process it'll run. Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.

Test period:: N/A (single event)
Deduplication:: 1 Day