tfMITRE ATT&CK sub-technique

VBA Stomping T1564.007

Tactic: Stealth
Platforms: Linux, macOS, Windows
Version: 2.0
Created: 17 September 2020
Last modified: 12 May 2026
Contributor: Rick Cole, Mandiant

Adversaries may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Office documents by replacing the VBA source code with benign data.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1564.007

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

VBA Stomping detection strategy DET0012

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for VBA Stomping

Enterprise

3 platforms

AN0034 · Windows

Discrepancies between VBA source code and p-code inside Office documents. Defender perspective: anomalies in file metadata streams, execution of Office processes loading macros without source code consistency, and script execution with no corresponding source metadata.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MonitoredExtensions	Expand or restrict which Office file types (.docm, .xlsm, .pptm) are flagged for VBA project analysis.
TimeWindow	Correlate Office process execution with subsequent script execution within a narrow window.

AN0035 · Linux

Execution of Wine or LibreOffice macros with inconsistent VBA metadata. Defender perspective: file analysis showing p-code embedded without matching source streams.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve calls to soffice.bin with suspicious macro execution flags
File MetadataDC0059	linux:syslog	Discrepancies in _VBA_PROJECT p-code vs source code extracted with oletools/pcodedmp

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ScannerTooling	Choice of OLE/P-code analysis utilities (oletools, pcodedmp, custom disassembler).

AN0036 · macOS

Opening of Office files where VBA source code appears benign or missing, but p-code remains active. Defender perspective: process execution of Office apps with macro execution lacking visible source components.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Process execution of Microsoft Word, Excel, PowerPoint with macro execution attempts
File MetadataDC0059	macos:unifiedlog	Detection of altered _VBA_PROJECT or PerformanceCache streams

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
OfficeVersionScope	Adjust for specific Office versions in use across macOS endpoints.

VBA Stomping detections T1564.007

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs