We will explore the boundaries and design weaknesses of AMSI for VBA that would allow attackers to bypass and evade this defensive mechanism. Note that attacks on the engine itself (such as in-memory patching) are out of scope for this post.

https://outflank.nl/blog/2019/04/17/bypassing-amsi-for-vba/
#evasion #vba #redteaming

Pafish Macro is a Macro enabled Office Document to detect malware analysis systems and sandboxes. It uses evasion & detection techniques implemented by malicious documents.

https://github.com/joesecurity/pafishmacro

#phishing #redteaming #vba #evasion

EXCEL4.0 MACROS - NOW WITH TWICE THE BITS!

Excel 4.0 macros (XLM), the older, awkward sibling of VBA, have been the focus of a couple of interesting offensive techniques. Since Stan Hegt and Pieter Ceelen of Outflank first played with the feature, and we have abused it for a funny little lateral movement technique and they have evolved to do some impressive work weaponizing it as a shellcode runner.

https://www.cybereason.com/blog/excel4.0-macros-now-with-twice-the-bits
#vba #macro #office #redteaming

Cracking VBA Project Passwords

https://blog.didierstevens.com/2020/07/20/cracking-vba-project-passwords/
#vba #windows #tools #bruteforce