oletools

Reported Context (2)

Oletools detects MacrosWe can run oleid to identify if any macros are present in the document and dump them further using tools like oledump. MuddyWater Uses RustyWater Implant in Middle East Spearphishing Campaign
To scan a DOCX file you feel might have the CVE-2021-40444 exploit, researcher @decalage has shared a Python script to use oletools and look for an mshtml:http external reference abused in this attack. Hackers Exploit CVE-2021-40444 Through Malicious Office and RTF Files

CVE (1)

Malware (2)

People (3)

Threat Actors (2)

MITRE ATT&CK (8)

Vendors (2)

Products (4)

Tools (7)

Industries (5)

Countries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.