Attachment with auto-executing macro (unsolicited)

calendar Dec 19, 2023  ·
Share on: linkedin copy

Attachment from an unsolicited sender contains a macro that will auto-execute when the file is opened.

Macros are a common phishing technique used to deploy malware.

Sublime rule (View on GitHub)

 1name: "Attachment with auto-executing macro (unsolicited)"
 2description: |
 3  Attachment from an unsolicited sender contains a macro that will auto-execute when the file is opened.
 4
 5  Macros are a common phishing technique used to deploy malware.  
 6references:
 7  - "https://www.trustedsec.com/blog/malicious-macros-for-script-kiddies/"
 8type: "rule"
 9severity: "medium"
10source: |
11  type.inbound
12  and any(attachments,
13          (
14            .file_extension in~ $file_extensions_macros
15            or (
16                  .file_extension is null
17                  and .file_type == "unknown"
18                  and .content_type == "application/octet-stream"
19                  and .size < 100000000
20            )
21          )
22          and any(file.oletools(.).macros.keywords, .type =~ "autoexec")
23  )
24  and (
25    not profile.by_sender().solicited
26    or (
27      profile.by_sender().any_messages_malicious_or_spam
28      and not profile.by_sender().any_false_positives
29    )
30  )
31
32  // negate replies
33  and (
34    length(headers.references) == 0
35    or not any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To")))
36  )  
37attack_types:
38  - "Malware/Ransomware"
39tactics_and_techniques:
40  - "Macros"
41detection_methods:
42  - "Archive analysis"
43  - "Header analysis"
44  - "File analysis"
45  - "Macro analysis"
46  - "OLE analysis"
47  - "Sender analysis"
48id: "af6624c3-2a28-5fbb-8936-fb29e55dd29d"
to-top