ATT&CK ReferencesPalo Alto Office Test Sofacy

Palo Alto Office Test Sofacy

Falcone, R. (2016, July 20). Technical Walkthrough: Office Test Persistence Method Used In Recent Sofacy Attacks. Retrieved July 3, 2017.

Techniques1

None recorded.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1137.002 Office Test	GroupAPT28	APT28 has used the Office Test persistence mechanism within Microsoft Office by adding the Registry key `HKCU\Software\Microsoft\Office test\Special\Perf` to execute code. Palo Alto Office Test Sofacy

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.