hunting for vba macros - SERP Analysis

https://luckyluk3.medium.com/hunting-office-macros-with-sysmon-and-pandas-46fe0c24357e

https://www.reddit.com/r/DefenderATP/comments/vthtlw/office_macro_advanced_hunting_query/

https://www.youtube.com/watch?v=soF5iyeeWDg

https://www.logpoint.com/en/blog/detecting-malicious-macros-is-a-vital-tool-in-the-fight-against-malware/

https://socfortress.medium.com/malicious-macros-detection-in-ms-office-files-using-olevba-752ed6b48c04

https://cloud.google.com/blog/topics/threat-intelligence/purgalicious-vba-macro-obfuscation-with-vba-purging/

https://learn.microsoft.com/en-us/answers/questions/575765/how-to-monitor-detect-microsoft-office-macro-execu

https://redcanary.com/blog/incident-response/malicious-excel-macro/

https://www.outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/

https://book.jorianwoltjer.com/forensics/vba-macros

https://www.offsec.com/blog/macro-weaponization/

https://www.sentinelone.com/cybersecurity-101/threat-intelligence/what-is-a-macro-virus/

https://www.cynet.com/attack-techniques-hands-on/office-macro-attacks/

https://www.microsoft.com/en-us/security/blog/2018/09/12/office-vba-amsi-parting-the-veil-on-malicious-macros/

https://www.depthsecurity.com/blog/obfuscating-malicious-macro-enabled-word-docs/

https://blog.talosintelligence.com/threat-actors-using-macropack/

https://www.certego.net/blog/advanced-vba-macros-bypassing-olevba-static-analyses/

https://stackoverflow.com/questions/267607/how-can-i-find-out-what-a-macro-does-without-exposing-myself-to-it

https://isc.sans.edu/diary/22322

https://www.reversinglabs.com/blog/spotting-malicious-excel4-macros

https://intezer.com/blog/analyze-malicious-microsoft-office-files/

https://www.politoinc.com/post/the-simplicity-of-vba-malware-part-1-of-2

https://any.run/cybersecurity-blog/macros-in-malware/

https://inquest.net/blog/extracting-sneaky-excel-xlm-macros/

https://www.youtube.com/watch?v=ZMPCjREMvak

https://research.splunk.com/endpoint/b12c89bc-9d06-11eb-a592-acde48001122/

https://www.ired.team/offensive-security/initial-access/phishing-with-ms-office/t1137-office-vba-macros

https://github.com/Antonlovesdnb/Antonlovesdnb.github.io/blob/master/index.md

https://detect.fyi/demystification-8base-threat-hunting-and-detection-opportunities-44c55c4c5667

https://doras.dcu.ie/22879/1/aics_34.pdf

https://unit42.paloaltonetworks.com/examining-vba-initiated-infostealer-campaign/

https://www.youtube.com/watch?v=l5sMPGjtKn0

https://therecord.media/microsoft-blocks-internet-macros-by-default-in-five-office-applications

https://blog.talosintelligence.com/whats-with-shared-vba-code/

https://isc.sans.edu/diary/27864

https://www.sentinelone.com/blog/malware-embedded-microsoft-office-documents-dde-exploit-macroless/

https://www.withsecure.com/en/expertise/blog-posts/dechaining-macros-and-evading-edr

https://github.com/reprise99/Sentinel-Queries/blob/main/Defender%20for%20Endpoint/Device-SummarizeMacroUsage.kql

https://malware.news/t/sans-isc-hunting-for-malicious-excel-sheets/10958

https://www.lares.com/blog/hunting-in-the-sysmon-call-trace/

https://newtonpaul.com/tag/vba/

https://www.itpro.com/security/368484/security-experts-bemoan-microsoft-macro-block-backtrack

https://www.youtube.com/watch?v=znoIo9f6Z8Q

https://heimdalsecurity.com/blog/excel-4-0-macros-will-be-disabled-in-order-to-protect-users/

https://www.linkedin.com/learning/excel-macros-in-depth

https://www.youtube.com/watch?v=lx5_kWh53_o

https://m.youtube.com/watch?v=Um2JwZfwoFI&pp=ygULI3ZiYXByb3RpcHM%3D

https://www.syspanda.com/index.php/2017/10/10/threat-hunting-sysmon-word-document-macro/

https://community.tableau.com/s/question/0D54T00000C5kOdSAJ/calling-the-excel-reshaper-addin-in-a-vba-macro

https://www.msofficeforums.com/word-vba/49291-word-macro-saving-files-variable-default-name.html

https://www.wiseowl.co.uk/vba-macros/exercises/excel-vba/messages-and-variables/5015/

https://www.ncsc.gov.uk/guidance/macro-security-for-microsoft-office

https://www.youtube.com/watch?v=KeCAdNVTr70

https://www.crowdstrike.com/en-us/blog/blocking-fileless-script-based-attacks-using-falcon-script-control-feature/

https://uk.indeed.com/career-advice/career-development/what-is-vba-macro

https://attack.mitre.org/techniques/T1059/005/

https://www.thebricks.com/resources/guide-how-to-debug-vba-code-in-excel

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/stealthy-vba-macro-embedded-in-pdf-like-header-helps-evade-detection/

https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion

https://www.producthunt.com/products/vba-code-generator

https://www.threatdown.com/blog/microsoft-is-now-disabling-excel-4-0-macros-by-default/

https://www.soa.org/news-and-publications/newsletters/compact/2014/january/com-2014-iss50/finding-excel-vba-bottlenecks/

https://www.xelplus.com/excel-vba-vs-office-scripts/

https://www.youtube.com/watch?v=XnN_UWfHlNM

https://vba.skilling.us/exercise/circle-bug-hunt

https://advance.sagepub.com/users/725295/articles/708611/master/file/data/paper/paper.docx

https://www.mrexcel.com/board/threads/vba-macros-running-slow-out-of-nowhere.1255081/

https://www.infosecinstitute.com/resources/security-awareness/excel-4-0-malicious-macro-exploits-what-you-need-to-know/

https://www.opswat.com/blog/excel-4-0-macro-old-feature-new-attack-technique

https://community.spiceworks.com/t/getting-runtime-error-2147467229-80004023-in-excel-vba-macro/743482

https://www.offsec.com/metasploit-unleashed/vbscript-infection-methods/

https://superuser.com/questions/1773660/microsoft-has-blocked-macros-for-excel-but-disable-macros-is-the-only-avail

https://swisskyrepo.github.io/InternalAllTheThings/redteam/access/office-attacks/

https://therecord.media/microsoft-says-decision-to-stop-blocking-office-vba-macros-by-default-is-temporary

https://www.reversinglabs.com/blog/excel-4.0-macros

https://www.youtube.com/watch?v=WRrzX7cGHaY

https://anomalyhunt.com/2020/05/22/vba-stomping/

https://chandoo.org/forum/threads/use-vba-to-force-printing-as-pdf.3337/

https://stackoverflow.com/questions/75664519/malicious-macro-detected-when-trying-to-run-python-script-from-excel-vba

https://www.wiseowl.co.uk/blog/s2854/build-vba-system.htm

http://www.vbaexpress.com/forum/archive/index.php/t-43553.html

https://www.mrexcel.com/board/threads/vba-code-to-return-a-list-of-accounts.1205541/

https://www.paloaltonetworks.com/blog/security-operations/detecting-vba-process-hollowing-with-cortex-xdr/

https://www.opswat.com/blog/deep-cdr-prevents-advanced-maldoc-techniques-vba-stomping

https://forum.ozgrid.com/forum/index.php?thread/1218441-vba-move-files-from-1-folder-to-another-only-need-select-to-this-code-if-possibl/

https://www.wesleyanargus.com/fetch.php/u51G5G/2381986/microsoftwordvbaguidebook.pdf

https://attack.mitre.org/

https://www.goskills.com/Excel/Resources/Free-Excel-templates

https://blog.pwntario.com/team-posts/antons-posts/hunting-malicious-macros

http://www.vbaexpress.com/forum/archive/index.php/t-21570.html

https://www.todyl.com/blog/understanding-visual-basic-for-applications-vba-macro-attacks

https://www.linkedin.com/learning/topics/microsoft-excel

https://zerotomastery.io/courses/

https://www.computerweekly.com/news/252523252/Cyber-criminals-pivot-away-from-macros-as-Microsoft-changes-bite

https://www.theregister.com/2023/05/15/proofpoint_microsoft_macros_cybercrime/

https://www.careerprinciples.com/all-courses

https://edu.gcfglobal.org/en/excel/

https://remotive.com/remote/jobs/data/assessment-implementation-analyst-1770493

https://www.simplilearn.com/tutorials/excel-tutorial/calculate-percentage-in-excel