attack_technique: T1137.002
display_name: 'Office Application Startup: Office Test'
atomic_tests:
- name: Office Application Startup Test Persistence
  auto_generated_guid: c3e35b58-fe1c-480b-b540-7600fb612563
  description: |
    Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office
    application is started. Key is used for debugging purposes. Not created by default & exist in HKCU & HKLM hives.
  supported_platforms:
  - windows
  input_arguments:
    thing_to_execute:
      description: Thing to Run
      type: Path
      default: C:\Path\AtomicRedTeam.dll
  executor:
    command: |
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf" /t REG_SZ /d "#{thing_to_execute}"
    cleanup_command: |
      reg delete "HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf" /f >nul 2>&1
    name: command_prompt
