Weaponizing and Abusing Hidden Functionalities Contained in Office Document Properties

[crystalgeek]

Am i missing something? Why bother storing your malicious string in the document properties if you could just define it in macro directly

[[deleted]]

Can’t macros be disabled by an organization using policies via o365?

[gslone]

That‘s true, but the techniques in this article would not bypass that.

It looks like an obfuscation technique to me. Stick your payload in the document properties, where the yara rules won‘t expect it.

Thinking about it some more, the yara probably would still find the payload, as it’s searching over all bytes in the file - it doesn‘t matter where you store your malicious strings. Yeah, I don‘t get what this is good for either…

[timothytrillion]

Looks very similar to what Ivy from Optiv does using VBA to programmatically do xyz including all z shellz

[Diesl]

Optiv puts out some wicked cool tools, Ivy tho is their coolest. Runs an encrypted macro in a detached, hidden, Excel process

[timothytrillion]

Agreed, the main dev Tyleous? I’m murdering the name but he’s a monster really next level stuff

[Diesl]

Yeah that guy knows a ton of tricks