Microsoft Office adds a value to autostart Registry key

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-09-24

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules
Detector Tags
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)
Severity	Low

Microsoft Office adds a value to a Registry entry (run keys, startup folders) to establish persistence.

Gain persistence on the host using the Window's autostart Mechanism.

Check the registry key and determine what process it'll run.
Check whether the executing process is benign, and if this was a desired behavior as part of its normal execution flow.