payloads-in-malicious-onenote-samples-en

Payload Trends in Malicious OneNote

Samples

Executive Summary

Next-Generation Firewall with cloud-delivered security services including WildFire.

Prisma Access devices with cloud-delivered security services including WildFire.

Cortex XDR and XSIAM agents help protect against post-exploitation activities using the multi-layer protection approach.

The Unit 42 Incident Response team can also be engaged to help with a compromise or to provide a proactive assessment to lower your risk.

In this post, we look at the types of embedded payloads that attackers leverage to abuse Microsoft OneNote files. Our analysis of roughly 6,000 malicious OneNote samples from WildFire reveals that these samples have a phishing-like theme where attackers use one or more images to lure people into clicking…