> For the complete documentation index, see [llms.txt](https://lookbook.cyberjungles.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lookbook.cyberjungles.com/random-research-area/phishing-with-ms-office-docs/vsto-and-malicious-office-docs.md). # VSTO and Malicious Office Docs These are the voyages of a security enthusiast. Its continuing mission: to explore strange new knowledge. To seek out new ideas and new technics. To boldly go where no one has gone before! It's not a bug, it's a feature! What is the Visual Studio Tools for Office (VSTO)? * **Visual Studio Tools for Office** (**VSTO**) is a set of development tools available in the form of a [Visual Studio](https://en.wikipedia.org/wiki/Visual_Studio) add-in (project templates) and a [runtime](https://en.wikipedia.org/wiki/Runtime_library) that allows [Microsoft Office](https://en.wikipedia.org/wiki/Microsoft_Office) [2003](https://en.wikipedia.org/wiki/Microsoft_Office_2003) and later versions of Office applications to host the [.NET Framework](https://en.wikipedia.org/wiki/.NET_Framework) [Common Language Runtime](https://en.wikipedia.org/wiki/Common_Language_Runtime) (CLR) to expose their functionality via .NET. {% embed url="" %} {% embed url="" %} {% embed url="" %} \ \ Any Malicious Payload can be emplaced into any office documents using VSTO. You can find detailed explanations in the below links. {% embed url="" %} {% embed url="" %} {% embed url="" %} Quick practice in a YouTube video: {% embed url="" %} **PS:** * More powerful than Macro and formula injection! You can write anything with C# smoothly. * It can update itself and .NET libraries in every execution. (OMG! It can be a self-updated dropper!) * EDRs can not detect in the same way as macros. **Prevention:** * Disable all add-ins for office in the Group Policy (This may not be useful for large companies.) ![](https://303615811-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LcAvWvRlcSk3lddJoVO%2Fuploads%2FjnY3n5H8ipHtIkIQEnXb%2Fimage.png?alt=media\&token=18bee130-11a0-4a4d-93af-d78923b2d6c6) * Require that application add-ins are signed by Trusted Publisher in the Group Policy. (There are many bypass ways for this(^^,) ) ![](https://303615811-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LcAvWvRlcSk3lddJoVO%2Fuploads%2F8yEDnryiTJXtWLWEpAsH%2Fimage.png?alt=media\&token=c2d58c57-2538-4bb4-99c8-e260fdfb3ea2) * I have not done it yet, but behavioral analysis can be done for this situation. Also, C# projects could be restricted with the company signature. If a subprocess of a C# project compiling and executing without a signature is observed under an office document, it can be blocked by the EDR. * Also, the below blog post should be read to create a prevention scenario against this kind of phishing attack. {% embed url="" %} -EOF --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://lookbook.cyberjungles.com/random-research-area/phishing-with-ms-office-docs/vsto-and-malicious-office-docs.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.