3 ms·
One of the latest avenues is sending the malicious macros in ISO files masquerading as legitimate documents or zip files. Ideally, email filtering would block t
by neodymiumphish 4y ago
One of the latest avenues is sending the malicious macros in ISO files masquerading as legitimate documents or zip files. Ideally, email filtering would block that attachment type across the board, but they definitely get by some platforms. What's more is that 7-zip-unpacked files lost their Mark-of-Web, leading to easier execution of malicious scripts as well (although I don't think 7-zip is a significant attack vector in many environments, since it's a non-default option.
- _8j50 4y agoI have had luck with isos as well because motw publisher check isn't done for exe's in them. But unless you have an encrypted zip, our email security will catch it before/after delivery and quarantine it after detonating the iso and its contents. I even tried stuffing the iso with very large files to hit some sort of a limit in automated analysis.