Wiki › Techniques, Tactics & Procedures (TTPs) › Execution › Macro-Based Execution

Macro-Based Execution

2 min read

Jump to:

Overview

Macro-Based Execution is a technique where adversaries leverage macros—scripts embedded within documents—to execute malicious code on a target system. Commonly used during the initial access and execution phases, this method exploits the trust users place in document files to initiate unauthorized actions. Attackers use macro-based execution to bypass traditional security controls and gain foothold within an environment.

Attack Objective

Execute arbitrary code to establish control over a target system
Supports Initial Access and Execution stages of the attack lifecycle
Enables attackers to run payloads that facilitate further compromise, persistence, or lateral movement

How the Technique Works

Adversaries embed malicious macros within documents such as Microsoft Office files. When a user opens the document and enables macros, the embedded script runs automatically, executing commands or downloading additional payloads. This execution can trigger a range of malicious activities, including code execution, system reconnaissance, or establishing command and control channels.

Common Methods & Variations

Embedding Visual Basic for Applications (VBA) macros in Office documents
Use of obfuscated or encrypted macro code to evade detection
Variants targeting on-premises endpoints and cloud-based document platforms
Living-off-the-land techniques leveraging legitimate scripting environments versus custom malware payloads

Indicators of Compromise (IOCs)

Unusual macro-enabled document files received via email or downloaded from the web
Execution of scripting processes such as wscript.exe or cscript.exe triggered by document applications
Network connections initiated by processes spawned from document macros
Suspicious registry or file system changes related to macro execution

Detection Strategies

Monitoring macro execution events and related process creation logs
Behavioral detection focusing on abnormal document activity or unexpected script execution
Correlation of email gateway logs with endpoint telemetry to identify macro-enabled document delivery

Mitigation & Prevention

Disabling macros by default and enabling them only when necessary under controlled conditions
Implementing application control policies to restrict execution of scripts initiated by documents
User training to recognize suspicious documents and avoid enabling macros from untrusted sources
Use of email filtering and sandboxing to block or analyze macro-enabled documents

Response Considerations

Immediate isolation of affected endpoints to prevent lateral spread
Analysis of macro-enabled documents and associated payloads to determine scope and intent
Review of network and endpoint logs to identify additional compromised systems or persistence mechanisms
Post-incident hardening including policy adjustments and user awareness reinforcement

Related Techniques

Phishing for Initial Access via malicious document delivery
Command and Scripting Interpreter for executing commands post-macro execution
Persistence through Registry Run Keys or Scheduled Tasks initiated by macro payloads
Lateral Movement using credentials or remote execution enabled by initial macro-based foothold

Mapping & References

MITRE ATT&CK T1204.002 – User Execution: Malicious File
MITRE ATT&CK T1059.003 – Command and Scripting Interpreter: Windows Command Shell
Public advisories on macro-based malware campaigns from cybersecurity vendors and CERTs
Incident reports detailing macro-enabled document exploitation in targeted attacks

Tags: Command & Control Cybersecurity Defense Evasion Document Exploitation endpoint security Execution Initial Access Macro Malware persistence Procedures Tactics Techniques Threat Detection