VBA Stomping

{
  "id": "ATTACK:enterprise:T1564.007",
  "title": "VBA Stomping",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1564/007",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--c898c4b5-bf36-4e6e-a4ad-5b8c4c13e35b",
  "external_id": "T1564.007",
  "domain": "enterprise",
  "created": "2020-09-17T12:51:40.845Z",
  "modified": "2026-05-12T15:12:00.716Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "pcodedmp Bontchev",
      "url": "https://github.com/bontchev/pcodedmp"
    },
    {
      "source_name": "FireEye VBA stomp Feb 2020",
      "url": "https://www.fireeye.com/blog/threat-research/2020/01/stomp-2-dis-brilliance-in-the-visual-basics.html"
    },
    {
      "source_name": "Evil Clippy May 2019",
      "url": "https://outflank.nl/blog/2019/05/05/evil-clippy-ms-office-maldoc-assistant/"
    },
    {
      "source_name": "Microsoft _VBA_PROJECT Stream",
      "url": "https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-ovba/ef7087ac-3974-4452-aab2-7dba2214d239"
    },
    {
      "source_name": "Walmart Roberts Oct 2018",
      "url": "https://medium.com/walmartglobaltech/vba-stomping-advanced-maldoc-techniques-612c484ab278"
    }
  ]
}