BalCCon2k22 - Robert Simmons

### Overview In this talk presented at BalCCon2k22, Robert Simmons (who uses the handle utkanos) discusses detecting malicious Excel 4.0 (XLM) macros within compound file binary (CFB) documents. Introduced in 1992 and largely supplanted by Visual Basic for Applications (VBA) in Excel 5.0 in 1993, Excel 4.0 macros saw little legitimate enterprise use after the early 1990s. Around 2020 through early 2022, threat actors such as Zloader and Dridex revived Excel 4.0 macros to evade security controls. Rather than reverse engineering macro behavior, Simmons focuses on fast, reliable structural detection inside compound files so security systems can immediately block or triage suspicious files.

### Key Topics - **History & Context:** Evolution from standalone Binary Interchange File Format (BIFF) files (Excel 2.0–4.0) to streams encapsulated within Compound File Binary structures in Excel 5.0 and beyond. - **Detection Opportunities:** Identifying Excel 4.0 macros across three primary structural locations: the Beginning of File (BOF) record, the Bound Sheet record, and the Document Summary Information stream. - **YARA Rule Crafting:** Developing robust, performant YARA rules while handling file fragmentation, atom selection, variable lengths, and bitwise arithmetic. - **Identifying Excel Compound Files:** Differentiating Excel documents from other compound files (e.g., Word, PowerPoint, MSI) via MIME type, root storage object Class ID (CLSID), and stream names (`book` vs `workbook`).

### Technical Details Simmons details three specific locations to detect Excel 4.0 macros: 1. **Beginning of File (BOF) Record:** Part of the BIFF format that always appears at the start of a sector. Marked by the magic number `09 08` (little-endian for `0809`), followed by record size (8 or 16 bytes) and version (`05 00` for BIFF5/BIFF7; `06 00` for BIFF8). A flag byte set to `40` specifies Excel macros. The 16-byte BIFF8 record also contains two trailing reserved null bytes, enabling clean YARA hex patterns that do not span sector fragments. 2. **Bound Sheet Record:** Contains metadata for each sheet in a workbook. Begins with magic number `85 00`. Preceding bytes specify the sheet name length and visibility state (`0` for visible, `1` for hidden, `2` for very hidden). Threat actors frequently insert non-zero values into reserved bits; applying a bitwise AND mask with `3` determines visibility, while values greater than 2 directly signal malicious tampering. A dedicated byte set to `01` explicitly signifies an Excel 4.0 macro sheet. 3. **Document Summary Information Stream:** Contains heading pairs identifying `Excel 4.0 Macro` sheets. Because string ordering depends on linguistic localization (pre-positive adjectives in English like `Excel 4.0 macros` vs. post-positive adjectives in Russian like `macrosy Excel 4.0`, or hyphens in Norwegian), matching rules must account for language variations. To prevent false positives from MSI files and installer patches, Simmons recommends matching property set headers (magic numbers and record lengths). However, because property sets can appear arbitrarily within the stream, they can cross sector boundaries and suffer fragmentation.

To identify Excel files before macro checking, Simmons presents methods to calculate the root storage object CLSID offset by parsing the sector shift (offset 30) and the first directory sector (offset 48), calculating offsets using bitwise left-shifts in YARA, or iterating through directory entries looking for `book` (BIFF5) or `workbook` (BIFF8).

### Takeaways Because legitimate business documents have virtually zero justification for containing Excel 4.0 macros today, detection at ingestion (such as email gateways) offers high-fidelity protection. The BOF record provides the most robust detection mechanism with near-zero circumvention risk, as altering or clearing the macro indicator corrupts or prevents the macros from executing. In contrast, Document Summary Information rules are more susceptible to evasion via deliberate sector fragmentation.