Thread by @inversecos

1\ How to prove malicious macro was enabled & clicked? 👀 #DFIR

HKEY_LOCAL_MACHINE\USERDAT\Software\Microsoft\Office\<VERS>\<PROGRAM>\Security\Trusted Documents\TrustRecords

Look ONLY for values where last four bytes are "FF FF FF 7F".

These files had macros enabled

👇👇👇

2\ In light of the recent Emotet campaigns, make sure you check INetCache Outlook folder as it stores the attachments that were opened in Outlook.

If AV quarantines the file this wont exist.

C:\Users\<name>\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\<Folder>\

3\ Next check the macro settings for that user as this user had macros set to auto enabled (VBAWarnings=1)

NTUSERDAT\Software\Microsoft\Office\<vers>\<program>\Security

Disable all macros w/o notification : 2, 4
Disable all macros except signed macros: 3
Enable all macros: 1

4\ Next step is to check recent files viewed/visited... you can look at:

> NTUSER.DAT artefacts
> LNK / Jmplists
> Microsoft Recent Files (C:\Users\<usr>\appdata\roaming\Microsoft\office\Recent)

6\ You can look for the OST/PST files but usually the INetCache covers this. You can look for this here

%UserProfile%\appdata\local\microsoft\outlook\

6\ In terms of execution of word/excel/outlook ... just look at the usual execution artefacts. You can do this using Prefetch, Shimcache (amcache likely not too relevant if this is user workstation) etc.

And also Security.evtx Event ID 4688 <3

7\ This is awesome, hopefully they extend this to more than just Excel!
bleepingcomputer.com/news/microsoft….

Happy hunting!! x