Lion Cipher Lab
Reconstruct a weaponized Office document's delivery chain: macro to payload
- Digital Forensics & IR (DFIR)
- Intermediate
- ~50 min
- Free · no account required
Why it matters
A macro-enabled Office document is still one of the most common ways an intruder lands the first foothold: it arrives as an ordinary-looking email attachment, and the moment someone opens it and enables content, a hidden program runs to pull down the real malware. MITRE ATT&CK tracks the delivery as Spearphishing Attachment (T1566.001), the click as User Execution: Malicious File (T1204.002), and the code that runs as Command and Scripting Interpreter (T1059). When a suspicious attachment lands in a real SOC, nobody double-clicks it — an analyst is handed the ARTIFACTS a safe pipeline already…
What you'll learn
- reading an OLE/OOXML file-structure listing to locate the macro stream
- reading Office document metadata (author, template, code page) for lure and attribution hints
- interpreting a deobfuscated VBA AutoOpen macro to find the command it builds
- reconstructing a spawned-process tree (WINWORD -> cmd -> powershell -> certutil -> payload)
- extracting IOCs (URLs, dropped filenames, hashes) from a maldoc artifact bundle
- mapping a maldoc to MITRE ATT&CK (T1566.001, T1204.002, T1059)
- judgment: when static macro analysis answers the question vs when you must detonate
Steps in this lab
- The scenario: an attachment landed, and a pipeline already did the dangerous part for you
- Artifact 1 — file structure and metadata: is there even a macro, and what does the wrapper tell us?
- Artifact 2 — the macro-analysis flag table: what the extractor already noticed
- Artifact 3 — the deobfuscated macro: read the command it actually builds
- Artifact 4 — the spawned-process tree: what the sandbox actually watched happen
- Reconstruct the chain and map it to MITRE ATT&CK
- Extract the IOCs the way a pro hands them off
- The judgment: when static analysis is enough, and when you must detonate
- The habit this builds