Microsoft Office adds a value to autostart Registry key

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent Requires: eXtended Threat Hunting (XTH)
Detection Modules
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)
Severity	Low

Microsoft Office adds a value to a Registry entry (run keys, startup folders) to establish persistence.

Gain persistence on the host using the Window's autostart Mechanism.

Check the registry key and determine what process it'll run.
Check whether the executing process is benign, and if this was a desired behavior as part of its normal execution flow.