liveBook · Manning

Macro

As explained in Cyber Threat Hunting

A macro is an embedded program or sequence of commands that automates actions within an application or document.

A macro is code embedded in a document that can run instructions when enabled. In a Word-document investigation, enabled macros are significant because the hidden code might contain malicious instructions. section 3.1.4

Treat macro activity as a timeline clue rather than proof of file contents. Sysmon process and registry events can show a document opening, macro-related activity, and later execution without access to the document itself. section 3.1.4

Tracing a macro-enabled document

A document opened from Downloads is followed by a WINWORD.EXE process using /Embedding. A Registry Create event records the document in Word Trusted Documents, indicating that editing and macros were explicitly enabled. Later process events connect Word to cscript, PowerShell, cmd, and rundll32 activity. section 3.1.4

Listing 3.12 Sysmon event containing winword.exe: Seventh event
{
  "@timestamp": "2021-11-21T13:02:25.000Z",
  "_raw": {
    "Channel": "Microsoft-Windows-Sysmon/Operational",
    "Computer": "DESKTOP-PC01",
    "Details": "Binary Data",
    "EventID": "13",
...
    "Image": "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE",
    "Keywords": "0x8000000000000000",
    "Level": "4",
    "Name": "Microsoft-Windows-Sysmon",
    "Opcode": "0",
    "ProcessGuid": "{10cf5a0f-4359-619a-1402-000000000700}",
    "ProcessID": "1872",
    "RuleName": "Context,ProtectedModeExitOrMacrosUsed",
    "SystemTime": "2021-11-21T13:02:25.194072300Z",
    "TargetObject": "HKU\S-1-5-21-789985733-1868513186-3804096106-1000\
     Software\Microsoft\Office\14.0\Word\Security\Trusted Documents\
     TrustRecords\%USERPROFILE%/Downloads/critical_list.doc",
    "Task": "13",
    "ThreadID": "3648",
    "User": "DESKTOP-PC01\pc01-user",
    "UserID": "S-1-5-18",
    "UtcTime": "2021-11-21 13:02:25.188",
    "Version": "2"
  },
...
}

Inspect the registry event’s rule name and trusted-document path to connect macro use to a specific Word document and timestamp. section 3.1.4

How Cyber Threat Hunting covers it

How deep it goes
Interprets process and registry telemetry around macro use but does not inspect macro code or document contents.
Examples
Follows critical_list.doc from Word opening and macro enablement to cscript, PowerShell, and rundll32 execution.
What it assumes
Assumes access to Sysmon events while deriving macro-use insight without document-content access.
What you can do after
Diagnose/debug with Sysmon evidence by correlating macro-related Word activity with subsequent process execution.
How it connects
Connects macros with Microsoft Word, Sysmon, Registry Create events, PowerShell, cmd, and rundll32.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

Also explained in

Compare how 9 books explain macro →

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.