Vba2Graph

Vba2Graph 一款面向安全研究人员的工具，帮助他们节省分析恶意Office宏的时间。 生成VBA调用图，并高亮显示潜在恶意关键词。 支持快速分析恶意宏，轻松理解执行流程。 @MalwareCantFly 功能特性 关键词高亮 支持VBA属性 支持外部函数声明 处理带有"Change"执行触发器的恶意宏 炫彩配色方案！ 优点 ✓ 非常快 ✓ 对大多数野外恶意宏表现良好 缺点 ✗ 静态分析（动态解析的调用无法识别） 示例 示例1： Trickbot下载器——利用对象Resize事件作为初始触发，随后触发TextBoxChange。 示例2： 更多案例请查看 Examples 文件夹。 ...

MacroShop

MacroShop 用于通过 Office 宏传递负载的脚本集合。大部分是 Python 脚本。详见 http://khr0x40sh.wordpress.com。 1. macrosafe.py 生成安全的 VB 代码，可嵌入 Excel 电子表格。需要一个由 Veil-Evasion PowerShell 负载生成的批处理文件。要包含该代码，请在 Office 中启用开发工具菜单，转到 Visual Basic 选项卡，双击 ThisWorkbook，然后粘贴输出文件的内容。语法如下： python macrosafe.py test.bat test.txt 2...

Mystikal

Mystikal macOS 初始访问载荷生成器 旨在与 https://github.com/its-a-feature/Mythic 配合使用 相关博文： https://posts.specterops.io/introducing-mystikal-4fbd2f7ae520 用法： 1. 在构建机上安装 Xcode（安装程序包与安装程序插件需要） 2. 安装 python 依赖 root@kitploit: sudo pip3 install -r requirements.txt 3. 修改 Settings/MythicSettings.py 文件中的设置以匹配你的 Myth...

luckystrike

luckystrike PowerShellベースの悪意のあるOfficeマクロ文書作成ユーティリティ。ペネトレーションテストまたは教育目的のみに使用すること。 はじめに 1. こちらをお読みください: http://www.shellntel.com/blog/2016/9/13/luckystrike-a-database-backed-evil-macro-generator. 2. Wikiをお読みください! 3. Win7-10マシン（32ビットまたは64ビット）を使用していることを確認してください。 4...

Simple Steps for Attack Surface Reduction

Story teaser text: Cybersecurity leaders face mounting pressure to stop attacks before they start, and the best defense may come down to the settings you choose on day one. In this piece, Yuriy Tsibere explores how default policies like deny-by-default, MFA enforcement, and application Ringfencin...

📄 Microsoft Excel LTSC 2024 Remote Code Execution

Microsoft Excel LTSC 2024 suffers from a remote code execution vulnerability. Titles: Microsoft Excel LTSC 2024 - Remote Code Execution RCE Author: nu11secur1ty Date: 06/16/2025 Vendor: Microsoft Software: https://www.microsoft.com/en/microsoft-365/excel?market=af Reference:...

New Attack Technique Exploits Microsoft Management Console Files

Threat actors are exploiting a novel attack technique in the wild that leverages specially crafted management saved console MSC files to gain full code execution using Microsoft Management Console MMC and evade security defenses. Elastic Security Labs has codenamed the approach GrimResource after...

Researchers Uncover New Attempts by Qakbot Malware to Evade Detection

The operators behind the Qakbot malware are transforming their delivery vectors in an attempt to sidestep detection. "Most recently, threat actors have transformed their techniques to evade detection by using ZIP file extensions, enticing file names with common formats, and Excel XLM 4.0 to trick...

Microsoft Patch Tuesday, July 2022 Edition

Microsoft today released updates to fix at least 86 security vulnerabilities in its Windows operating systems and other software, including a weakness in all supported versions of Windows that Microsoft warns is actively being exploited. The software giant also has made a controversial decision t...

Microsoft Patch Tuesday, February 2022 Edition

Microsoft today released software updates to plug security holes in its Windows operating systems and related software. This months relatively light patch batch is refreshingly bereft of any zero-day threats, or even scary critical vulnerabilities. But it does fix four dozen flaws, including...

Hackers Now Hiding ObliqueRAT Payload in Images to Evade Detection

Cybercriminals are now deploying remote access Trojans RATs under the guise of seemingly innocuous images hosted on infected websites, once again highlighting how threat actors quickly change tactics when their attack methods are discovered and exposed publicly. New research released by Cisco Tal...

Malicious MS Office Macro Creator

Evil Clippy is a tool for creating malicious Microsoft Office macros: At BlackHat Asia we released Evil Clippy, a tool which assists red teamers and security testers in creating malicious MS Office documents. Amongst others, Evil Clippy can hide VBA macros, stomp VBA code via p-code and confuse...

wePWNise - Generates Architecture Independent VBA Code To Be Used In Office Documents Or Templates And Automates Bypassing Application Control And Exploit Mitigation Software

wePWNise is proof-of-concept Python script which generates VBA code that can be used in Office macros or templates. It was designed with automation and integration in mind, targeting locked down environment scenarios. The tool enumerates Software Restriction Policies SRPs and EMET mitigations and...

New Malware Family Uses Custom UDP Protocol for C&C Communications

Security researchers have uncovered a new highly-targeted cyber espionage campaign, which is believed to be associated with a hacking group behind KHRAT backdoor Trojan and has been targeting organizations in South East Asia. According to researchers from Palo Alto, the hacking group, which they...

“Ready Player One” – Are you Ready to Protect Your Endpoints from the Bad Guys?

At times it can feel like a game as you watch the cyber-breach scorecards. Yahoo 3 billion users, Equifax 143 million consumers, Uber 57 million users, Imgur 1.7 million users are just a sample of the companies that have released new information on large breaches in the last few months...

FIN7 Evolution and the Phishing LNK

FIN7 is a financially-motivated threat group that has been associated with malicious operations dating back to late 2015. FIN7 is referred to by many vendors as “Carbanak Group”, although we do not equate all usage of the CARBANAK backdoor with FIN7. FireEye recently observed a FIN7 spear phishin...

CVE-2016-0141

The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save operation, which allows attackers to obtain sensitive information via unspecified vectors, aka "Microsoft Information Disclosure Vulnerability."...

MacroShop - Collection of scripts to aid in delivering payloads via Office Macros

Collection of scripts to aid in delivering payloads via Office Macros. Most are python. 1. macrosafe.py Generates safe for VB inclusion into an excel spreadsheet. Requires a batch file generated by Veil-Evasion powershell payloads. To include, enable the developer menu in Office, head to Visual...

Microsoft Office Macros Configuration

Nessus was able to collect Office macro configuration information for active accounts on the remote Windows host and generate a report as a CSV attachment. C Tenable Network Security, Inc. include"compat.inc"; if !definedfunc"nasllevel" || nasllevel 5200 exit0, "Not Nessus 5.2+"; if description...

Dridex Banking Trojan Spreading Via Office Macros

The left-for-dead Office macro has apparently made a comeback with cybercriminals who have found them to be a good hiding place for banking malware. Recently, Microsoft reported a spike in the use of macros in hacking campaigns, peaking in mid-December. This has been corroborated by researchers a...