High Severity
Attachment: Macro with Suspected Use of COM ShellBrowserWindow Object for Process Creation
Description
Macro references the ShellBrowserWindow COM object which can be used to spawn new processes from Explorer.exe rather than as a child process of the Office application. This can be useful for a threat actor attempting to evade security controls.
References
type.inbound
and any(attachments,
(
.file_extension in~ $file_extensions_macros
or (
.file_extension is null
and .file_type == "unknown"
and .content_type == "application/octet-stream"
and .size < 100000000
)
)
and any(file.explode(.),
any(.scan.strings.strings,
strings.ilike(., "*new:C08AFD90-F2A1-11D1-8455-00A0C91F3880*")
)
)
)
Playground
Test against your own EMLs or sample data.