T1564.007 — VBA Stomping

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Office documents by replacing the VBA source code with benign data. MS Office documents with embedded VBA content store source code inside of module streams. Each module stream has a PerformanceCache…

Sub-technique of Hide Artifacts (T1564).

Sigma detection rules (3)

T1564.007 Hide Artifacts: VBA Stomping

title: "T1564.007 Hide Artifacts: VBA Stomping"
id: d4795167-d1cc-48d2-b982-7d432ef8781e
description: 'VBA stomping (overwriting the VBA source in a module stream while leaving compiled p-code intact) is a static document-structure technique not directly observable via Windows Sysmon/Security telemetry. Closest defensible runtime proxy: an Office application spawning a script/command interpreter child process, which is the observable side-effect when a stomped macro''s p-code actually executes. Tune using: MonitoredExtensions, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1564/007
author: Shahrukh Khan
date: 2026-05-10
license: MIT
tags:
  - attack.stealth
  - attack.t1564.007

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_parent:
    ParentImage|endswith:
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\POWERPNT.EXE'
      - '\MSACCESS.EXE'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'

  condition: selection_parent and selection_child

falsepositives:
  - Legitimate business macros that shell out to command interpreters or scripting engines for automation.

level: medium

T1564.007 Hide Artifacts: VBA Stomping

title: "T1564.007 Hide Artifacts: VBA Stomping"
id: 2d55809d-5840-434c-bd24-96fe7008244e
description: 'VBA Stomping is a Microsoft Office-specific technique: it exploits a mismatch between the human-readable VBA source stored in a module stream and the separately-compiled p-code cached in the streams PerformanceCache, so that a VBA source-code scanner sees benign code while Office actually executes malicious p-code. This is exclusively an OLE compound-file/static-document-analysis phenomenon with no Linux or LibreOffice runtime equivalent, and no Linux auditd process-execution telemetry can observe a p-code/source mismatch inside a document. This rule is retained only as a placeholder, low-value proxy on LibreOffice headless document conversion; it does NOT detect VBA stomping and should not be relied upon for this technique. Genuine detection requires static parsing of OLE VBA project streams (e.g. via oletools/olevba or Evil Clippy-style tooling) against the actual document file, independent of host process telemetry. Tune using: ScannerTooling.'
references:
  - https://attack.mitre.org/techniques/T1564/007
author: Shahrukh Khan
date: 2026-03-18
license: MIT
tags:
  - attack.stealth
  - attack.t1564.007

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/libreoffice'
      - '/soffice.bin'
    a1|contains: '--convert-to'

  condition: selection

falsepositives:
  - Not applicable as a real detection - VBA stomping has no Linux equivalent; headless LibreOffice document conversion is routine batch-processing activity (format conversion pipelines, document previews) unrelated to this technique.

level: informational

T1564.007 Hide Artifacts: VBA Stomping

title: "T1564.007 Hide Artifacts: VBA Stomping"
id: 87e7095c-fd05-4e66-8c63-1bd2a38ff973
description: 'Detection Strategy for VBA Stomping. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: OfficeVersionScope.'
references:
  - https://attack.mitre.org/techniques/T1564/007
author: Shahrukh Khan
date: 2026-03-29
license: MIT
tags:
  - attack.stealth
  - attack.t1564.007

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/Microsoft Word'
      - '/Microsoft Excel'
    ParentImage|endswith: '/soffice'

  condition: selection

falsepositives:
  - Unified log process telemetry cannot see inside a documents VBA p-code versus source code mismatch, so this only flags unusual parent-child relationships, not the stomping itself.

level: medium

Related sub-techniques

Explore