T1564.007No distinct observable

VBA Stomping

StealthLinux, macOS, Windows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

The one thing that makes VBA stomping distinct from an ordinary macro is a byte-level fact about a saved document -- that the compiled p-code inside a module stream's PerformanceCache no longer matches (or has no) corresponding VBA source text -- and that fact does not exist on any of the three logsources this brief supplies. AN0034's Windows legs are Sysmon EventID 11 (file_event, TargetFilename only) and EventID 1 (process_creation, Image/CommandLine only); neither carries OLE compound-file stream contents, so a rule against either can see 'a.docm was written' or 'WINWORD.EXE ran', which is every macro-enabled document opened or saved on the estate, stomped or not. […]

What the technique is

Adversaries may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Office documents by replacing the VBA source code with benign data. MS Office documents with embedded VBA content store source code inside of module streams. Each module stream has a PerformanceCache that stores a separate compiled version of the VBA source code known as p-code. The p-code is executed when the MS Office version specified in the _VBA_PROJECT stream (which contains the version-dependent description of the VBA project) matches the version of the host MS Office application. An adversary may hide malicious VBA code by overwriting the VBA source code location with zero’s, benign code, or random bytes while leaving the previously compiled malicious p-code. Tools that scan for malicious VBA source code may be bypassed as the unwanted code is hidden in the compiled p-code. If the VBA source code is removed, some tools might even think that there are no macros present. If there is a version match between the _VBA_PROJECT stream and host MS Office application, the p-code will be executed, otherwise the benign VBA source code will be decompressed and recompiled to p-code, thus removing malicious p-code and potentially bypassing dynamic analysis.

Read it on attack.mitre.org

What MITRE says you would watch

AN0034
Discrepancies between VBA source code and p-code inside Office documents. Defender perspective: anomalies in file metadata streams, execution of Office processes loading macros without source code consistency, and script execution with no corresponding source metadata.
AN0035
Execution of Wine or LibreOffice macros with inconsistent VBA metadata. Defender perspective: file analysis showing p-code embedded without matching source streams.
AN0036
Opening of Office files where VBA source code appears benign or missing, but p-code remains active. Defender perspective: process execution of Office apps with macro execution lacking visible source components.