{"id":"T1564.007","name":"VBA Stomping","url":"https://attack.mitre.org/techniques/T1564/007","tactics":["stealth"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0012","stix_id":"x-mitre-detection-strategy--6d2e2f19-f5ae-4ba0-aea7-52cc257169e5","name":"Detection Strategy for VBA Stomping","url":"https://attack.mitre.org/detectionstrategies/DET0012","analytics":[{"id":"AN0034","stix_id":"x-mitre-analytic--0ea214f3-5d66-4170-b33d-58a6577bb074","name":"Analytic 0034","description":"Discrepancies between VBA source code and p-code inside Office documents. Defender perspective: anomalies in file metadata streams, execution of Office processes loading macros without source code consistency, and script execution with no corresponding source metadata.","url":"https://attack.mitre.org/detectionstrategies/DET0012#AN0034","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"MonitoredExtensions","description":"Expand or restrict which Office file types (.docm, .xlsm, .pptm) are flagged for VBA project analysis."},{"field":"TimeWindow","description":"Correlate Office process execution with subsequent script execution within a narrow window."}],"live":true,"detection_strategies":["DET0012"],"techniques":["T1564.007"]},{"id":"AN0035","stix_id":"x-mitre-analytic--f9f7e5e7-edbf-442b-b4ea-d35455982ba8","name":"Analytic 0035","description":"Execution of Wine or LibreOffice macros with inconsistent VBA metadata. Defender perspective: file analysis showing p-code embedded without matching source streams.","url":"https://attack.mitre.org/detectionstrategies/DET0012#AN0035","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve calls to soffice.bin with suspicious macro execution flags","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"linux:syslog","channel":"Discrepancies in _VBA_PROJECT p-code vs source code extracted with oletools/pcodedmp","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"linux-syslog"}],"mutable_elements":[{"field":"ScannerTooling","description":"Choice of OLE/P-code analysis utilities (oletools, pcodedmp, custom disassembler)."}],"live":true,"detection_strategies":["DET0012"],"techniques":["T1564.007"]},{"id":"AN0036","stix_id":"x-mitre-analytic--025e89c6-9383-48b5-b9f2-85ab31b6a7bb","name":"Analytic 0036","description":"Opening of Office files where VBA source code appears benign or missing, but p-code remains active. Defender perspective: process execution of Office apps with macro execution lacking visible source components.","url":"https://attack.mitre.org/detectionstrategies/DET0012#AN0036","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Process execution of Microsoft Word, Excel, PowerPoint with macro execution attempts","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Detection of altered _VBA_PROJECT or PerformanceCache streams","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"OfficeVersionScope","description":"Adjust for specific Office versions in use across macOS endpoints."}],"live":true,"detection_strategies":["DET0012"],"techniques":["T1564.007"]}],"live":true,"version":"1.0","techniques":["T1564.007"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}