VBA DLL Loaded Via Office Application

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•17

Detects when a Microsoft Office application (Excel, Publisher, OneNote, Outlook, PowerPoint, Word) loads specific Visual Basic for Applications (VBA) related DLLs (VBE7.DLL, VBEUI.DLL, VBE7INTL.DLL). This activity can indicate the presence and execution of VBA macros, which are often used by adversaries for initial access or execution.