Bypassing Endpoint Controls Using Office Macros - Techniques and Defenses

This course demonstrates how a booby-trapped Excel document can use a malicious macro to bypass endpoint controls, establish command and control, exfiltrate data, and achieve remote code execution. It also covers Base64 encoding and indicators to monitor.

Syllabus

Countdown
Intro
What we're doing today
Excel Macro Document
Exploring the Macro
Attack Surface Reduction
Bypassing Defenses
Using Command and Control
Sneaky Data Exfiltration
Base64 Encoding in the Macro
What to Monitor For
Remote Code Execution
Kody Shout-out
Closing Thoughts
Endscreen