Tag Archives: malware

Detecting Malware Payloads in Office Document Metadata

Office Documents with Malicious Metadata

Ever consider document properties like “Company,” “Title,” and “Comments” a vehicle for a malicious payload? Checkout this nifty PowerShell payload in the company metadata:

Here’s the full VirusTotal entry. The target opens the Office document and, with macros enabled, the payload stored within the document’s own metadata executes and does its work. No extra files written to disk or network requests made.

The question  about whether DatAlert can detect stuff like this came up in the Twitter thread, so I decided to write up a quick how-to.

Finding Malicious Metadata with Varonis

What you’ll need: DatAdvantage, Data Classification Framework, DatAlert

Step 1: Add Extended File Properties to be scanned by Data Classification Framework.

  • Open up the Varonis Management Console
  • Click on Configuration → Extended File properties
  • Add a new property for whichever field you’d like to scan (e.g., “Company”)

Varonis Management Console

(Note: prior to version 6.3, extended properties are created in DatAdvantage under Tools → DCF and DW → Configuration → Advanced)

Step 2: Define a malicious metadata classification rule

  • In the main menu of DatAdvantage select Tools → DCF and DW → Configuration
  • Create a new rule
  • Create a new filter
  • Select File properties → Company (or whichever property you’re scanning)
  • Select “like” to search for a substring
  • Add the malicious value you’d like to look for (e.g., .exe or .bat)

Varonis DCF New Classification Rule

Step 3: Create an alert in DatAlert to notify you whenever a file with malicious metadata is discovered

  • In the main menu of DatAdvantage select Tools → DatAlert
  • Click the green “+” button to create a new rule
  • Click on the “Where (Affected Object)” sub menu on the left
  • Add a new filter → Classification Results
  • Select your rule name (e.g., “Malicious Metadata”)
  • Select “Files with hits” and “Hit count (on selected rules)” greater than 0

DatAlert Rule for Malicious Document Metadata

You can fill out the rest of the details of your alert rule–like which systems to scan, how you want to get your alerts, etc.

As an extra precaution, you could also create a Data Transport Engine rule based on the same classification result that will automatically quarantine files that are found to have malicious metadata.

That’s it! You can update your “Malicious Metadata” over time as you see reports from malware researchers of new and stealthier ways to encode malicious bits within document metadata.

If you’re an existing Varonis customer, you can setup office hours with your assigned engineer to review your classification rules and alerts. Not yet a Varonis customer? What are you waiting for? Get a demo of our data security platform today.

Lessons from the Malware Museum

Lessons from the Malware Museum

If you haven’t already seen Mikko Hypponen’s collection of vintage malware at the Internet Archive, take the time for a brief tour. If you’re on a lunch hour, it’s also worthwhile to hear Mikko’s talk on how malware has evolved from its primitive roots.

Hunter-Gatherer Ware

The interesting point about these early viruses is that the hackers seemed to get an unhealthy pleasure in pranking anonymous users.  The hackers craved the idea of an 8-bit graphic crawling across your monitor (see Walker or Ambulance) or just displaying a large ‘V’ once a month (that would be the V-sign virus) or a cool fractal (Tequila).

More creative hackers had some really impressive graphics chops, considering the available technology: check out this Martian landscape. These early pioneers had style!

Unlike today’s malware, the attackers also put their personal stamp on their work: you were supposed to take notice.

In one of the first known viruses (see Brain), the attackers even left their street address in their DOS-based executable. Oops.

It was a more innocent time.

But even these earlier viruses had a destructive element. Take for example Casino, which asked victims to play a virtual game of slots. If your luck ran out, the disk was erased.


Vintage malware: Walker

In the pre-Internet and early-modem era, you’d share floppy disks with your friends and workers. The viruses were designed to replicate by infecting the boot sector of the diskette. As users, we all literally walked the virus to the next target — “sneaker-net”. Floppy-based Brain became a world-wide phenomenon.

Primitive, but effective.

Modern Malware

With the dawn of Microsoft Windows and Internet email — cue up 2001:A Space Odyssey theme music — viruses advanced into a more familiar form.

They began to embed themselves in Word or Excel documents using VBA scripts, so they were much harder to detect than the previous generation. They spread by secretly reading Outlook contacts and emailing themselves to the next victim.

Melissa and Code Red were classics of this worm genre.

Hackers also started to exploit people’s primeval urges to click on anything that’s sent to them in their emails, especially if it had a catchy subject line involving attractive female superstars — see the Anna Kournikova virus.

And around 2002-2003, came Fizzer. Its malware developers realized that people were using their laptops to store valuable information or enter it into web sites — passwords, credit card numbers. Fizzer secretly logged keystrokes and scanned documents, and used a backdoor to exfiltrate it to the attacker’s server.

Back to the Future

It’s 2016 and we’re still suckers when it comes to clicking on links or attachments found in our emails.

True, phishing attacks are much more targeted and can occasionally catch the best prepared of us off guard.

However, the techniques are ancient and at this point the digital equivalent of three-card monte. Far too many of us are still falling for Nigerian scams involving $100,000 and a wealthy oil trader named Mr. George Abdul.

With the rise of ransomware, the attackers are now back to boldly announcing their presence while encrypting files.

Will we ever get rid of malware? The answer is no: it’s really the Internet’s oldest profession, and it will be with us forever.

DatAdvantage is a modern answer to an age-old problem. Learn how it can protect your data from the inside out.