Full Report
In May, Microsoft plans to roll out a new Windows scheduled task that launches automatically to help Microsoft Office apps load faster. [...]
Analysis Summary
# Morning News Roll-up March 21, 2025
## Overview
This morning's intelligence focuses on Microsoft's deployment of a new persistence-like mechanism for Office optimization, alongside critical vulnerabilities in VMware tools and emerging zero-day campaigns targeting Windows systems through Management Console files.
## Top Stories
### Microsoft to Deploy New "Startup Boost" Scheduled Tasks
- Summary: Microsoft is rolling out a new feature in May 2025 that automatically creates Windows scheduled tasks to preload Office applications. While intended for performance, the mechanism recreates itself after every update even if disabled by the user.
- Source: hxxps://www[.]bleepingcomputer[.]com/news/microsoft/microsoft-new-windows-scheduled-task-will-launch-office-apps-faster/
### EncryptHub Linked to MMC Zero-Day Attacks
- Summary: Threat actors are exploiting a zero-day vulnerability in Microsoft Management Console (MMC) to target Windows systems. The campaign is linked to the EncryptHub group.
- Source: hxxps://www[.]bleepingcomputer[.]com/news/security/encrypthub-linked-to-zero-day-attacks-targeting-windows-systems/
### Broadcom Warns of VMware Tools Authentication Bypass
- Summary: A critical authentication bypass vulnerability has been identified in VMware Tools for Windows, potentially allowing attackers to gain unauthorized access to guest operating systems.
- Source: hxxps://www[.]bleepingcomputer[.]com/news/security/broadcom-warns-of-authentication-bypass-in-vmware-windows-tools/
***
# Main Topic
Microsoft Office "Startup Boost" Scheduled Task Rollout
## Key Points
- **Automated Performance Optimization:** Microsoft will introduce a new scheduled task that preloads Office applications in a "paused state" upon system logon or reboot to decrease application load times.
- **Rollout Schedule:** Deployment begins in mid-May 2025, with worldwide General Availability (GA) expected by late May 2025.
- **System Requirements:** The feature only activates on systems meeting specific hardware thresholds: at least 8 GB RAM and 5 GB of free disk space.
- **Persistent Behavior:** A notable technical detail is that the Office Installer will automatically recreate the scheduled tasks during every update cycle, effectively overriding user-defined "disabled" states.
- **Energy Awareness:** The task is designed to be automatically disabled when Windows "Energy Saver" mode is active.
## Threat Actors
- **Attribution:** Microsoft Corporation (Official Software Update).
- **Security Context:** While not a "malicious" actor, the mechanism introduces new persistent scheduled tasks which are frequently monitored by security teams as potential indicators of persistence (T1053).
## TTPs
- **Scheduled Task/Job (T1053.005):** Creation of new tasks named `Office Startup Boost` and `Office Startup Boost Logon`.
- **Pre-loading/Hooking:** Preloads application components into memory in a suspended state to reduce execution latency.
- **Persistence:** Re-installation of the task via the Microsoft Office Installer during routine update cycles.
## Affected Systems
- **Platforms:** Windows 10 and Windows 11.
- **Software:** Microsoft Office desktop applications (Microsoft 365).
- **Hardware Constraints:** Systems with >8 GB RAM and >5 GB free disk space.
## Mitigations
- **User Configuration:** Navigate to **Options > General** within an Office application and uncheck **Startup Boost**.
- **Administrative Note:** Administrators should be aware that this setting may revert after each Office update, requiring potential Group Policy (GPO) or registry-based enforcement if permanent disabling is required.
- **Task Management:** Manual deletion via `taskschd.msc` (though the installer will recreate it).
- **Power Management:** Enabling **Energy Saver** mode will suppress the task execution.
## Conclusion
While "Startup Boost" is a performance-enhancing feature, its behavior—specifically the automatic recreation of scheduled tasks after user deletion—mimics persistence techniques often used by malware. Security operations centers (SOC) should baseline these new scheduled tasks (`Office Startup Boost`) to avoid false positive alerts in EDR/SIEM platforms starting in May 2025.