In 2017 MS Office files accounted for just 5% of malicious email attachments – this jumped to 48% by the end of 2018
A recent report by Symantec reveals that Microsoft Office files are increasing used as the delivery mechanism for malicious payloads over email, especially targeting businesses. In 2017 MS Office files accounted for just 5% of malicious email attachments – this jumped to 48% by the end of 2018, according to the report. Typically the MS Office file contains a native MS Office macro which downloads and executes a PowerShell script which in turn downloads and executes the malware. Symantec noted that the use of malicious PowerShell scripts increased by a whopping 1,000% in 2018 compared to the previous year.
The use of the software already installed in a business to leverage an attack is known as ‘living off the land’ or ‘LotL.’ This is becoming an increasing popular attack vector for cyber criminals. The two main reasons for this appear to be the reduction in the number of available zero day exploits due to the established bug-bounty programmes provided by vendors and security companies and also because by using the existing software systems criminals hope to hide their activities in the background noise of legitimate business operations on the network.
By using the same tools needed by System Administrators to do their job everyday, ‘living off the land’ techniques can be challenging to defend against. For example the SysInternals tool PsExec can be used to execute a program on a remote systems. Useful for Sys Admins and also used by cyber criminals during the Petya malware attack in the summer of 2017. The Sys Internals team recognises the challenge noting on the PSTool webpage that the software has been used by malware and can trigger alerts from anti-virus software.
Microsoft provides information on how to disable macros in MS Office and Office 365 and system administrators can set global policies to help protect end users for accidentally enabling malicious macros within MS Office documents.
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)