I've recently written a simple keylogger using classic DLL-injection technique. I wanted to simulate a real phishing attack where the user opens an Office document with macros and by enabling them he downloads and runs my keylogger. While the keylogger itself is not being recognized as a thread, the VBA script is.

I've searched for a similar question and I've only found questions about how to obfuscate metasploit/empire payloads. I've even tried some of them, but they all got recognized as a threat (I've used msfvenom shinkata as encoder).

I don't want to use any existing tools. I'd like to learn how Windows Defender recognizes that piece of VBA script as malicious. I've read that it uses both signature-based scanning along with runtime execution analysis. All bypassing techniques which I've found on internet tried to obfuscate code which in my understanding can only try to bypass the signature scanning part.

Environment: default Windows 10 configuration

Also if any of you know a way to force Windows Defender to tell me why it recognized my code as a threat (for example "use of unsafe function", etc) it would be super helpful!

  • Its very tough passing windows defender in 2020,what you are looking for is heavily obfuscated download and execute code in vba.You need to piece together and experiment to figure out what works with defender and what doesn't – Vipul Nair Jun 20 at 12:30

You need to Obfuscate the VBA Script in order to make it FUD (Fully UnDetectable)

You can use the ChrW() function, which allows you to type ASCII characters instead of the actual characters themselves.

If you could share your code maybe we could try to assist you with this ("use of unsafe function"). I advise you to dive into someone else's code in github and try to check out their steps in order to verify your code, you'll be able to notice a difference.

| improve this answer | |
  • This will not work in 2020 – Vipul Nair Jun 20 at 12:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.