Inspect PDF documents for embedded Office macro-files

[paul.fritzsche1]

Hey guys,

last week us hit jaff ransomware. Some users got suspicious mails and opended the attached .pdf file, allow execution in Adobe Reader and MS Office started and loaded macro code. This code had downloaded some more files from the web and executed them on the local machine to encrypte C: and attached drives (yes, we have low security settings).

The ESA supports features to inspect office files for macro-code (with message filters), its described in user guide, https://supportforums.cisco.com/discussion/12925121/block-office-documents-containing-macros and serveral forums.

Is it possible to scan .pdf files in the same/similar way, to detect attached Office files (maybe with Office macros) in mailflow (on ESA) and take some actions on it? Inspection of .pdf files like this is basically possible.

For this threat see https://blogs.cisco.com/security/talos/jaff-ransomware-player-2-has-entered-the-game.

Thanks and best regards, Paul.

[Sriram Subramanian · Accepted solution]

Hello,

You can now configure a content filter in ASyncOS 10.0.1 to detect macro detection for PDF and Office Documents. You can find more information on how to configure in the user guide:

http://www.cisco.com/c/dam/en/us/td/docs/security/esa/esa10-0/ESA_10-0-1_User_Guide.pdf (page 206)

To scan and detect macro files, it would be recommended to install AMP feature for ESA which includes File Reputation and File Analysis for protection against malicious files including Macro detection.