Detection proposal: VBA Stomping (T1564.007) - EvilClippy execution and vbaProject.bin creation by non-Office process
维护者通常 1 天内回复
评估
调研方向
Start by checking the detection conventions under detections/ on develop and the equivalent SigmaHQ proposal, then identify the ESCU format and review process for new detections. The issue specifies two analytics: EvilClippy process execution and non-Office, non-archiver creation of vbaProject.bin. Done means submitting both SPL detections with naming, status, and analytic story placement aligned to maintainer guidance; attack data and tests need maintainer direction.
由索引模型根据 Issue 内容生成。
描述
Hi team! 👋
I would like to contribute two new detections for VBA Stomping (T1564.007, Defense Evasion). As of today ESCU has no detection covering this technique (verified against detections/ on develop).
Background: VBA stomping removes the VBA source code from an Office document while keeping the compiled p-code, so the macro still executes but the malicious source is invisible to static analysis tools and even the VBA editor. EvilClippy (Outflank) is the best-known open-source tool implementing this technique. MITRE reference: https://attack.mitre.org/techniques/T1564/007/
Proposed detections:
- EvilClippy execution -
Endpoint.Processesdatamodel,process_name/original_file_name=EvilClippy.exe(Sysmon EID 1 / Security 4688 / EDR telemetry) - vbaProject.bin creation by a non-Office process -
Endpoint.Filesystemdatamodel,file_name=vbaProject.binwhere the creating process is NOT an Office application (WINWORD/EXCEL/POWERPNT/MSACCESS/OUTLOOK/...) and not a common archiver (7z, WinRAR, Bandizip), since a legitimately saved macro project is always written by the Office host process (Sysmon EID 11)
Prior art: I have just submitted equivalent coverage to SigmaHQ (SigmaHQ/sigma#6595) and would love to port it to SPL for ESCU.
Attack data: I could not find EvilClippy or vbaProject datasets in splunk/attack_data, so the initial PR will not include unit tests. I am happy to help record/generate attack data if maintainers point me to the preferred process, or the team can generate it with attack_range as usual.
CLA: I am completing the individual contributor agreement now and will confirm it in the PR.
Happy to adjust naming, status, and analytic story placement per maintainer feedback. Thanks!
- 主要语言
- Python
- 星标
- 1.7k
- 派生
- 507
- 平均合并
- 3 天 18 小时
- 30 天内合并 PR
- 36
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
splunk/security_content 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 65/100
splunk/security_content#4401 ·
维护者通常 1 天内回复
-
enhancement
难度 2/5 1-3 小时 新手友好度 72/100
splunk/security_content#4400 ·
维护者通常 1 天内回复
-
bug
难度 4/5 3-5 天 新手友好度 42/100
splunk/security_content#4399 ·
维护者通常 1 天内回复
-
enhancement
难度 4/5 3-5 天 新手友好度 55/100
splunk/security_content#4393 · 3 条评论 ·
维护者通常 1 天内回复
-
enhancement
难度 4/5 3-5 天 新手友好度 30/100
splunk/security_content#4389 · 1 条评论 ·
维护者通常 1 天内回复
查看 splunk/security_content 的全部 Issue
相似的 Issue
-
question
难度 1/5 1 小时以内 新手友好度 68/100
vllm-project/vime#524 ·
维护者通常 7 天内回复
-
WOPI editor page is scrollable by a few pixels, which breaks scrolling in the document (Firefox)未关闭
难度 2/5 1-3 小时 新手友好度 84/100
suitenumerique/drive#969 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 67/100
theupdateframework/python-tuf#3044 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 84/100
FAIRmat-NFDI/pynxtools#861 ·
-
难度 2/5 1-3 小时 新手友好度 76/100
NVIDIA/nsight-python#88 ·
维护者通常 1 天内回复