nMacrorecorder10

Hunt Hypothesis

This rule detects the presence of the nMacrorecorder10 YARA signature, which typically indicates the use of a macro recording or automation tool that could be leveraged by adversaries to execute malicious VBA code or automate post-exploitation tasks. Proactively hunting for this indicator in Azure Sentinel allows the SOC team to identify potential footholds or persistence mechanisms in environments where macro-based attack vectors are common, ensuring early detection of low-severity threats that may escalate in impact.

YARA Rule

rule nMacrorecorder10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A network administrator uses the built-in Microsoft Excel Macro Recorder to automate the creation of a standardized report template for the finance department. The recorder saves the macro into the ThisWorkbook object, triggering the YARA signature which looks for specific VBA byte patterns associated with recorded macros.

  • Filter/Exclusion: Exclude files where the parent process is EXCEL.EXE and the file path ends with .xlsm or .xlsb in user-specific directories (e.g., C:\Users\<user>\Documents\), provided the file was created within the last 24 hours and the size is less than 50KB.

• Scenario: An IT support technician uses AutoHotkey (AHK) or a similar scripting tool to generate a batch of configuration scripts for endpoint deployment. The generated VBA-like code or embedded macro strings in the script file match the heuristic pattern of the nMacrorecorder10 rule, even though the file is a .txt or .ahk script rather than a native Office document.

  • Filter/Exclusion: Exclude files with extensions other than Office document types (.doc, .docx, .xls, .xlsx, .ppt, .pptx) from this specific YARA rule evaluation, or add a condition that requires the file header to match Office Open XML or OLE2 compound document signatures.

• Scenario: A developer uses Visual Studio Code with the Office.js extension to test a new Excel add-in. The extension’s debugging process temporarily writes a test macro file to the system’s temp directory (%TEMP%) to validate the add-in’s functionality, which matches the YARA pattern for recorded macro structures.

  • Filter/Exclusion: Exclude files located in standard temporary directories (%TEMP%, C:\Windows\Temp, `