MacroShop

MacroShop Набор скриптов для помощи в доставке полезных нагрузок через макросы Office. Большинство написано на Python. Подробности см. на http://khr0x40sh.wordpress.com. 1. macrosafe.py Генерирует безопасный для включения в VBA код для таблицы Excel. Требуется пакетный файл, созданный с помощью...

Vba2Graph

Vba2Graph 악성 Office 매크로 분석에 시간을 낭비하는 보안 연구자들을 위한 도구입니다. VBA 호출 그래프를 생성하며, 잠재적인 악성 키워드를 강조 표시합니다. 악성 매크로의 빠른 분석과 실행 흐름 이해를 쉽게 해줍니다. @MalwareCantFly 기능 키워드 강조 VBA 속성 지원 외부 함수 선언 지원 "Change" 실행 트리거를 사용하는 까다로운 매크로 멋진 색상 구성! 장점 ✓ 꽤 빠름 ✓ 야생에서 관찰된 대부분의 악성 매크로에서 잘 작동함 단점 ✗ 정적 동적으로 해석된 호출은 인식되지 않음 예제 예제 1...

Mystikal

Mystikal Генератор полезной нагрузки для начального доступа macOS Предназначен для использования с https://github.com/its-a-feature/Mythic Связанная запись в блоге: https://posts.specterops.io/introducing-mystikal-4fbd2f7ae520 Использование: 1. Установите Xcode на сборочной машине требуется для...

luckystrike

luckystrike 악성 Office 매크로 문서 생성을 위한 PowerShell 기반 유틸리티입니다. 침투 테스트 또는 교육 목적으로만 사용하세요. 시작하기 1. 이 문서를 읽으세요: http://www.shellntel.com/blog/2016/9/13/luckystrike-a-database-backed-evil-macro-generator. 2. 위키를 읽으세요! 3. Win7-10 32비트 또는 64비트 머신인지 확인하세요. 4. 최신 버전의 PowerShellv5+을 실행 중이어야 합니다. 5. Microsoft...

Simple Steps for Attack Surface Reduction

Story teaser text: Cybersecurity leaders face mounting pressure to stop attacks before they start, and the best defense may come down to the settings you choose on day one. In this piece, Yuriy Tsibere explores how default policies like deny-by-default, MFA enforcement, and application Ringfencin...

📄 Microsoft Excel LTSC 2024 Remote Code Execution

Microsoft Excel LTSC 2024 suffers from a remote code execution vulnerability. Titles: Microsoft Excel LTSC 2024 - Remote Code Execution RCE Author: nu11secur1ty Date: 06/16/2025 Vendor: Microsoft Software: https://www.microsoft.com/en/microsoft-365/excel?market=af Reference:...

New Attack Technique Exploits Microsoft Management Console Files

Threat actors are exploiting a novel attack technique in the wild that leverages specially crafted management saved console MSC files to gain full code execution using Microsoft Management Console MMC and evade security defenses. Elastic Security Labs has codenamed the approach GrimResource after...

Researchers Uncover New Attempts by Qakbot Malware to Evade Detection

The operators behind the Qakbot malware are transforming their delivery vectors in an attempt to sidestep detection. "Most recently, threat actors have transformed their techniques to evade detection by using ZIP file extensions, enticing file names with common formats, and Excel XLM 4.0 to trick...

Microsoft Patch Tuesday, July 2022 Edition

Microsoft today released updates to fix at least 86 security vulnerabilities in its Windows operating systems and other software, including a weakness in all supported versions of Windows that Microsoft warns is actively being exploited. The software giant also has made a controversial decision t...

Microsoft Patch Tuesday, February 2022 Edition

Microsoft today released software updates to plug security holes in its Windows operating systems and related software. This months relatively light patch batch is refreshingly bereft of any zero-day threats, or even scary critical vulnerabilities. But it does fix four dozen flaws, including...

Hackers Now Hiding ObliqueRAT Payload in Images to Evade Detection

Cybercriminals are now deploying remote access Trojans RATs under the guise of seemingly innocuous images hosted on infected websites, once again highlighting how threat actors quickly change tactics when their attack methods are discovered and exposed publicly. New research released by Cisco Tal...

Malicious MS Office Macro Creator

Evil Clippy is a tool for creating malicious Microsoft Office macros: At BlackHat Asia we released Evil Clippy, a tool which assists red teamers and security testers in creating malicious MS Office documents. Amongst others, Evil Clippy can hide VBA macros, stomp VBA code via p-code and confuse...

wePWNise - Generates Architecture Independent VBA Code To Be Used In Office Documents Or Templates And Automates Bypassing Application Control And Exploit Mitigation Software

wePWNise is proof-of-concept Python script which generates VBA code that can be used in Office macros or templates. It was designed with automation and integration in mind, targeting locked down environment scenarios. The tool enumerates Software Restriction Policies SRPs and EMET mitigations and...

New Malware Family Uses Custom UDP Protocol for C&C Communications

Security researchers have uncovered a new highly-targeted cyber espionage campaign, which is believed to be associated with a hacking group behind KHRAT backdoor Trojan and has been targeting organizations in South East Asia. According to researchers from Palo Alto, the hacking group, which they...

“Ready Player One” – Are you Ready to Protect Your Endpoints from the Bad Guys?

At times it can feel like a game as you watch the cyber-breach scorecards. Yahoo 3 billion users, Equifax 143 million consumers, Uber 57 million users, Imgur 1.7 million users are just a sample of the companies that have released new information on large breaches in the last few months...

FIN7 Evolution and the Phishing LNK

FIN7 is a financially-motivated threat group that has been associated with malicious operations dating back to late 2015. FIN7 is referred to by many vendors as “Carbanak Group”, although we do not equate all usage of the CARBANAK backdoor with FIN7. FireEye recently observed a FIN7 spear phishin...

CVE-2016-0141

The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save operation, which allows attackers to obtain sensitive information via unspecified vectors, aka "Microsoft Information Disclosure Vulnerability."...

MacroShop - Collection of scripts to aid in delivering payloads via Office Macros

Collection of scripts to aid in delivering payloads via Office Macros. Most are python. 1. macrosafe.py Generates safe for VB inclusion into an excel spreadsheet. Requires a batch file generated by Veil-Evasion powershell payloads. To include, enable the developer menu in Office, head to Visual...

Microsoft Office Macros Configuration

Nessus was able to collect Office macro configuration information for active accounts on the remote Windows host and generate a report as a CSV attachment. C Tenable Network Security, Inc. include"compat.inc"; if !definedfunc"nasllevel" || nasllevel 5200 exit0, "Not Nessus 5.2+"; if description...

Dridex Banking Trojan Spreading Via Office Macros

The left-for-dead Office macro has apparently made a comeback with cybercriminals who have found them to be a good hiding place for banking malware. Recently, Microsoft reported a spike in the use of macros in hacking campaigns, peaking in mid-December. This has been corroborated by researchers a...