Search and filter across all detection sources
176 rules
Attachment with high risk VBA macro (unsolicited)
Potentially malicious attachment containing a VBA macro. Oletools categorizes the macro risk as 'high'.
Suspicious VBA macros from untrusted sender
Detects any VBA macro attachment that scores above a medium confidence threshold in the Sublime Macro Classifier.
Attachment: Suspicious VBA macro
Detects any VBA macro attachment that scores above a low confidence threshold in the Sublime Macro Classifier.
SUSP_Macro_StarOffice [yara]
Suspicious macro in StarOffice
Disable Macro Runtime Scan Scope
Detects tampering with the MacroRuntimeScanScope registry key to disable runtime scanning of enabled macros
Trojan_Macro_RESUMEPLEASE_1 [yara]
Detects FireEye's macro RESUMEPLEASE
New Outlook Macro Created
Detects the creation of a macro file for Outlook.
Suspicious Outlook Macro Created
Attachment with auto-executing macro (unsolicited)
Attachment from an unsolicited sender contains a macro that will auto-execute when the file is opened. Macros are a common phishing technique used to deploy malware.
[FIPAYPIN] Replace macro from outside RFC1918
apt_sidecopy_malicious_macro [yara_rules]
Detects malicious macro used by SideCopy
gen_macro_ShellExecute_action [yara]
VBA macro technique to call ShellExecute to launch payload
MacromediaWindowsFlashProjectorPlayerv30 [packers]
MacromediaWindowsFlashProjectorPlayerv40 [packers]
MacromediaWindowsFlashProjectorPlayerv50 [packers]
MacromediaWindowsFlashProjectorPlayerv60 [packers]
Office Macro File Creation
Detects the creation of a new office macro files on the systems
Office_AutoOpen_Macro [yara]
Detects an Microsoft Office file that contains the AutoOpen Macro function
SUSP_Macro_Sheet_Obfuscated_Char [yara]
Finding hidden/very-hidden macros with many CHAR functions
Contains_VBA_macro_code [maldocs]
Detect a MS Office document with embedded VBA macro code