Detecting and Mitigating VBA Stomping (T1564.007)

A scanner that reads macro source code sees what the document wants it to see. VBA Stomping (T1564.007) is a Stealth technique for Linux, macOS and Windows, and a subtechnique of Hide Artifacts.

How attackers use it

MITRE explains that Office documents with embedded VBA store source code in module streams. Each module stream has a PerformanceCache holding a separate compiled version of the code, known as p-code. The p-code runs when the Office version recorded in the _VBA_PROJECT stream matches the host application's version.

An adversary can overwrite the source location with zeros, benign code or random bytes, while leaving the previously compiled malicious p-code in place. Tools that scan VBA source can then be bypassed, because the unwanted code now lives only in the compiled form. If the source is removed, some tools may even conclude there are no macros at all.

If the versions match, the p-code is executed. If they do not, the benign source is decompressed and recompiled to p-code, which removes the malicious p-code and may defeat dynamic analysis.

How to detect it

MITRE's analytics focus on mismatches:

• Discrepancies between VBA source code and p-code inside Office documents.
• Anomalies in file metadata streams.
• Office processes running macros with no visible or consistent source.
• On Linux, Wine or LibreOffice macros with inconsistent VBA metadata, found through file analysis that shows p-code without matching source.

Document analysis tools that compare source and p-code are the direct answer. For triage on endpoints, an Office process running a macro that your scanner reported as having none or as benign is the case to chase.

How to reduce the risk

MITRE lists one mitigation: disable or remove feature or program. Turn off or restrict access to VB components that are not needed. If nobody in a department uses macros, no policy exception is needed.

Quick check

Sources

• MITRE ATT&CK T1564.007: VBA Stomping