Skip to main content

Microsoft Office File Enrichment - Oletools

This Playbook is part of the Oletools Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.5.0 and later.

Oletools is a tool for analyzing Microsoft OLE2 files, such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics, and debugging. This playbook will run run the "oleid" command on the files which are passed to to it as playbook inputs. In case any macros or external relationships were found, it will also run "olevba" and "oleobj" commands as well on the relevant files. oleid - Analyze OLE files to detect specific characteristics usually found in malicious files. oleobj - Extract embedded objects from OLE files. olevba - Extract and analyze VBA Macro source code from MS Office documents (OLE and OpenXML).

Dependencies#

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks#

This playbook does not use any sub-playbooks.

Integrations#

This playbook does not use any integrations.

Scripts#

  • Set
  • Oletools

Commands#

This playbook does not use any commands.

Playbook Inputs#


NameDescriptionDefault ValueRequired
FileObjectA list of file objects. Default is "File" key.File.NoneRequired
DecodeAvailable values: "True" or "False". Default is "False"
When this is set to "True", in case a macro was found within the file, it will output all the obfuscated strings with their decoded content (Hex, Base64, StrReverse, Dridex, VBA).
FalseOptional
NonSecretPasswordWill be used to decrypt encrypted files. Encrypted files cannot be analyzed otherwise.
Please note that this input is "Non Secret" because it will be visible as plain text.
Optional

Playbook Outputs#


PathDescriptionType
Oletools.Oleid.ole_command_resultIndicator list from the oleid command.unknown
Oletools.Oleid.file_nameFile name.unknown
Oletools.Oleid.sha256SHA256 hash.unknown
Oletools.Oleid.ole_command_result.File_formatIndicator file format.unknown
Oletools.Oleid.ole_command_result.Container_formatIndicator container format.unknown
Oletools.Oleid.ole_command_result.EncryptedIndicator encrypted.unknown
Oletools.Oleid.ole_command_result.VBA_MacrosIndicator VBA macros.unknown
Oletools.Oleid.ole_command_result.XLM_MacrosIndicator XLM macros.unknown
Oletools.Oleid.ole_command_result.External_RelationshipsIndicator external relationships.unknown
Oletools.Oleid.ole_command_result.ObjectPoolIndicator object pool.unknown
Oletools.Oleid.ole_command_result.Flash_objectsIndicator flash objects.unknown
Oletools.Oleid.ole_command_result.File_format.ValueIndicator file format value.unknown
Oletools.Oleid.ole_command_result.File_format.Ole_RiskIndicator file format OLE risk.unknown
Oletools.Oleid.ole_command_result.File_format.DescriptionIndicator file format description.unknown
Oletools.Oleid.ole_command_result.Container_format.ValueIndicator container format value.unknown
Oletools.Oleid.ole_command_result.Container_format.Ole_RiskIndicator container format OLE risk.unknown
Oletools.Oleid.ole_command_result.Container_format.DescriptionIndicator container format description.unknown
Oletools.Oleid.ole_command_result.Encrypted.ValueIndicator encrypted value.unknown
Oletools.Oleid.ole_command_result.Encrypted.Ole_RiskIndicator encrypted OLE risk.unknown
Oletools.Oleid.ole_command_result.Encrypted.DescriptionIndicator encrypted description.unknown
Oletools.Oleid.ole_command_result.VBA_Macros.ValueIndicator VBA macros value.unknown
Oletools.Oleid.ole_command_result.VBA_Macros.Ole_RiskIndicator VBA macros OLE risk.unknown
Oletools.Oleid.ole_command_result.VBA_Macros.DescriptionIndicator VBA macros description.unknown
Oletools.Oleid.ole_command_result.XLM_Macros.ValueIndicator XLM macros value.unknown
Oletools.Oleid.ole_command_result.XLM_Macros.Ole_RiskIndicator XLM macros OLE risk.unknown
Oletools.Oleid.ole_command_result.XLM_Macros.DescriptionIndicator XLM macros description.unknown
Oletools.Oleid.ole_command_result.External_Relationships.ValueIndicator XLM macros value.unknown
Oletools.Oleid.ole_command_result.External_Relationships.Ole_RiskIndicator XLM macros OLE risk.unknown
Oletools.Oleid.ole_command_result.External_Relationships.DescriptionIndicator XLM macros description.unknown
Oletools.Oleid.ole_command_result.ObjectPool.ValueIndicator object pool value.unknown
Oletools.Oleid.ole_command_result.ObjectPool.Ole_RiskIndicator object pool OLE risk.unknown
Oletools.Oleid.ole_command_result.ObjectPool.DescriptionIndicator object pool description.unknown
Oletools.Oleid.ole_command_result.Flash_objects.ValueIndicator Flash objects value.unknown
Oletools.Oleid.ole_command_result.Flash_objects.Ole_RiskIndicator Flash objects OLE risk.unknown
Oletools.Oleid.ole_command_result.Flash_objects.DescriptionIndicator Flash objects description.unknown
Oletools.Oleobj.ole_command_result.hyperlinksList of hyperlinks.unknown
Oletools.Oleobj.file_nameFile name.unknown
Oletools.Oleobj.sha256SHA256 hash.unknown
Oletools.Olevba.file_nameFile name.unknown
Oletools.Olevba.sha256SHA256 hash.unknown
Oletools.Olevba.ole_command_result.macro_analyzeMacro analyze.unknown
Oletools.Olevba.ole_command_result.macro_src_codeMacro source code.unknown
Oletools.Olevba.ole_command_result.macro_listMacro list.unknown
DBotScore.IndicatorThe indicator that was tested.unknown
DBotScore.TypeThe indicator type.unknown
DBotScore.VendorThe vendor used to calculate the score.unknown
DBotScore.ScoreThe actual score.unknown

Playbook Image#


Microsoft Office File Enrichment - Oletools