attack.t1137.002 | Detection.FYI

Office Application Startup - Office Test

Aug 12, 2024 · attack.persistence attack.t1137.002 ·
Share on:

Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started

Read More
Suspicious Microsoft Office Child Process - MacOS

Aug 12, 2024 · attack.execution attack.persistence attack.t1059.002 attack.t1137.002 attack.t1204.002 ·
Share on:

Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution

Read More