I Can Name That Exploit in One Note

 Another New Day and Another New Way...

By Dominic Alvieri

February 3rd, 2023

@AlvieriD

Do your steganographic skills suck? Never fear 2023 is here. I guess I wasted years practicing the dark art of stego now with so many new ways to discretely infect, compromise and take over your target. 

How? Hiding your malicious file in an empty element is one way recently disclosed by researchers. Needless to say there are several other ways to play around with elements.

Another popular choice... embedding a malicious file within One Note. 

You can't hard code all of your website. It's just not practical. Now that Microsoft has disabled macros threat actors are finding new ways to infiltrate networks. One Note has taken center stage and Microsoft Visual Studio just joined the fray. 

Here is a short list of files to closely examine or block that are being abused by TAs

.msha

.htm

.lnk

.js

You can do this with many different files and ways.

Ill leave you with this partial...

c:\ encrypt files

\"what?"\ attrib -h (?) -r  ("nice-try")

Redacted