AN0034
Analytic 0034
Windows
Discrepancies between VBA source code and p-code inside Office documents. Defender perspective: anomalies in file metadata streams, execution of Office processes loading macros without source code consistency, and script execution with no corresponding source metadata.
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=1
[MonitoredExtensions]
Expand or restrict which Office file types (.docm, .xlsm, .pptm) are flagged for VBA project analysis.
[TimeWindow]
Correlate Office process execution with subsequent script execution within a narrow window.
AN0035
Analytic 0035
Linux
Execution of Wine or LibreOffice macros with inconsistent VBA metadata. Defender perspective: file analysis showing p-code embedded without matching source streams.
auditd:SYSCALL
execve calls to soffice.bin with suspicious macro execution flags
linux:syslog
Discrepancies in _VBA_PROJECT p-code vs source code extracted with oletools/pcodedmp
[ScannerTooling]
Choice of OLE/P-code analysis utilities (oletools, pcodedmp, custom disassembler).
AN0036
Analytic 0036
macOS
Opening of Office files where VBA source code appears benign or missing, but p-code remains active. Defender perspective: process execution of Office apps with macro execution lacking visible source components.
macos:unifiedlog
Process execution of Microsoft Word, Excel, PowerPoint with macro execution attempts
macos:unifiedlog
Detection of altered _VBA_PROJECT or PerformanceCache streams
[OfficeVersionScope]
Adjust for specific Office versions in use across macOS endpoints.