TA0005 · DEFENSE EVASION
VBA Stomping
Adversaries may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Office documents by replacing the VBA source code with benign data. MS Office documents with embedded VBA content store source code inside of module streams.
Detect it with
Detection efforts should be placed finding differences between VBA source code and p-code. VBA code can be extracted from p-code before execution with tools such as the pcodedmp disassembler.
Why it matters on shift
VBA Stomping is one of the concrete ways adversaries achieve defense evasion. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After defense evasion, the next tactic is usually Credential Access. Search your telemetry for the transition before closing the ticket.
Kill-chain context