SANS - "Inhibiting Malicious Macros by Blocking Risky API Calls"

  Microsoft Office Macros have been the bane of security analysts' lives since the late 1990s. Their flexibility and functionality make them ideal for malware authors to use as a primary stage payload delivery mechanism, and to datethe challenge they pose remains unsolved. Many organisations refrain from blocking them completely due to the impact it … Continue reading Inhibiting Malicious Macros by Blocking Risky API Calls

from SANS Digital Forensics and Incident Response Blog http://digital-forensics.sans.org/blog/2018/04/15/inhibiting-malicious-macros-by-blocking-risky-api-calls