msoffice.startup

$ target-query <path/to/target> -f msoffice.startup
Details

Module

dissect.target.plugins.apps.productivity.msoffice.MSOffice

Output

records

Module documentation

Microsoft Office productivity suite plugin.

Function documentation

Returns all startup items found in Microsoft Office startup folders.

Office startup folders are specific directories where Microsoft Office looks add-ins, macros, templates, or custom scripts. These are used to automatically load when the corresponding Office application starts up. These folders allow users and administrators to automate launching add-ins, executing scripts, or applying custom settings.

References:

Yields a OfficeStartupItem with fields:

path (path): The full path to the startup item.
creation_time (datetime): The creation time of the startup item.
modification_time (datetime): The modification time of the startup item.