A Software Engineering Approach into Analyzing Microsoft Office-Based Email Attacks

Phishing emails are among today's most common attack vectors since most enterprises and consumer users still rely on email for day-to-day operations. At the same time, some functionalities (such as MACRO support and Visual Basic Programming) available in Microsoft Office Suite make it easier for an attacker to inject malicious code into a document that can be sent via email. From a research perspective, analyzing such an attack implies understanding not only the artifacts that compose the kill chain steps but also being able to extract, from a document, the embedded macros and the scripts. This paper focuses on building such a system using the forensics platform GView by adding various plugins and functionalities designed to augment the existing support and allow a security researcher to analyze the content of an email and attached documents quickly.