.. / Microsoft Visual Studio Tools for Office (VSTO)

Star

• Phishing
• Persistence

VSTO is functionality available in Visual Studio, which allows the user to craft a .NET Office Add-in to be shipped with an office document.

• https://www.deepinstinct.com/blog/no-macro-no-worries-vsto-being-weaponized-by-threat-actors
• https://medium.com/@airlockdigital/make-phishing-great-again-vsto-office-files-are-the-new-macro-nightmare-e09fcadef010
• https://bohops.com/2018/01/31/vsto-the-payload-installer-that-probably-defeats-your-application-whitelisting-rules/
• https://github.com/deepinstinct/VSTO-POC

Phishing

		    Create a VSTO document (Word, Powerpoint, etc) embedded with a DLL file written in .NET and send it to any user. Once the user opens the documents and approves the "Add-In" installation, code will be executed.
		

Persistence

		    Utilize a different VSTO payload "Add-In" and include the code for any of the persistence techniques. After successful installation, persistence will be achieved. For more information, see "VSTO-POC" in references.