High Severity
Attachment with macro calling executable
Description
Recursively scans files and archives to detect embedded VBA files with an encoded hex string referencing an exe.
This may be an attempt to heavily obfuscate an execution through Microsoft document.
References
No references.
Sublime Security
Created Aug 17th, 2023 • Last updated Dec 19th, 2023
Feed Source
Sublime Core Feed
Source
type.inbound
and any(attachments,
(
.file_extension in~ $file_extensions_macros
or .file_extension in~ $file_extensions_common_archives
or (
.file_extension is null
and .file_type == "unknown"
and .content_type == "application/octet-stream"
and .size < 100000000
)
)
and any(file.explode(.), any(.scan.vba.hex, strings.ilike(., "*exe*")))
)
Playground
Test against your own EMLs or sample data.