Office Test Key
A DLL Office 2007 to 2016 load at startup, from a key with no version in its path.
Use it to find a DLL registered to load as Office starts, in a key a clean install never has.
- NTUSER.DAT
- Persistence
What It Proves
The default value of the Office test Special Perf key names a DLL that Office applications load at startup. Public reporting documents this for Office 2007 to 2016. It is version independent in those builds, so one entry covered Word, Excel and the rest.
What It Does Not Prove
The key does not exist on a clean machine, so its presence is itself suspect, and whether current Microsoft 365 builds still load it is not publicly confirmed. The HKCU copy affects one user, and the HKLM copy affects all.
Where It Lives
Office Test Key lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
NTUSER.DAT\C:\What It Looks Like
These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| alice's hive has no Office test key, so no DLL is set to load as her Office applications start. Office never creates it, so absent is the clean state. |
| The machine hive has no Office test key either, so nothing is set for every user. It is documented for Office 2007 to 2016, and current builds are unconfirmed. |
How to Read It
Check whether the Office test Special Perf key exists in HKCU or HKLM at all. Read the default value, which is the DLL path loaded into Office applications. Any DLL here is worth treating as persistence, since Office does not create this key itself.
- When Windows Writes It
- When the key is created, usually by an attacker.
- Which Windows Versions
- Microsoft Office on Windows 7 to 11
- Tools That Parse It
- Autoruns, Registry Explorer, RECmd
Hunt It
Microsoft does not say which keys Defender records, so confirm it records this one first. The key is absent by default, so any write is a strong signal, though not proof that Office loaded the DLL.
// Creation of the Office test Special Perf keyDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Office Test Key shows.
- Office Application Loads a DLL, Sysmon Event 7Not in the RegistryShows the DLL loading into Office, which matters as newer builds may ignore the key.
Sources
The facts on this page come from these public pages, which say more on each point.