What is a malicious macro?¶
A malicious macro is embedded script or automation within a document that is used to perform unauthorised activity.
Avoid the dangerous assumption¶
The dangerous assumption is that opening the document proves the macro executed.
It may not.
Execution may depend on:
- the application
- security settings
- user approval
- document format
- protected-view controls
- whether macros were enabled
- the specific operating environment.
A malicious macro may launch commands, create files, download malware, collect information or alter system settings.
Investigators should preserve:
- the original document
- the delivery message or download source
- document metadata
- macro code
- security warnings
- application and process records
- created files
- network connections
- later payloads.
Ask what the user did.
Did they open the document?
Did they enable content?
Did they dismiss a warning?
Did the application block the macro?
Do not assume that a macro-capable document is malicious merely because it contains automation. Macros are used legitimately in many organisations.
Likewise, a security alert may identify suspicious macro content without proving execution.
The process chain is important. A document application launching a command shell or scripting engine may support malicious execution, but context still matters.
Specialist analysis may explain capability, while system evidence establishes what actually happened.
Document previews, automated scanning and sandboxing may also open or inspect documents without ordinary user action. Those events should not be confused with deliberate user execution unless the source is established.
Source attribution therefore matters.
Operational takeaway¶
Separate document delivery, opening, macro enablement, code execution and resulting activity before concluding that a malicious macro caused compromise.