Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

olevba - keywords to detect remote template unlinking and VBA removal #864

Open
decalage2 opened this issue Aug 13, 2024 · 0 comments
Open

olevba - keywords to detect remote template unlinking and VBA removal #864

decalage2 opened this issue Aug 13, 2024 · 0 comments
Assignees
@decalage2
Labels
olevba 👍 enhancement
Milestone
Next Release

Comments

@decalage2
Copy link
Owner

See https://medium.com/@john.woodman11/vba-macro-remote-template-injection-with-unlinking-self-deletion-49aef5eec0cd

Potential keywords:

  • .VBComponents.Remove
  • .CodeModule.DeleteLines
  • .AttachedTemplate (but this one will trigger false positives, it is just an indication that the macro manipulates the attached template)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@decalage2 decalage2

Labels
olevba 👍 enhancement
Projects
None yet
Milestone
Next Release
Development

No branches or pull requests
1 participant
@decalage2