Office Drama on macOS

Explore the growing threat of macro-based Office attacks on macOS in this Black Hat conference talk. Delve into the analysis of recent macro-laden documents targeting Apple's desktop OS, with a focus on macOS-specific exploit code and payloads. Learn about the OUTLINE, MACROS ANALYSIS, SANDBOX BYPASS techniques, QUARANTINED / NOTARIZATION processes, and FULL EXPLOIT CHAINS. Gain insights into DETECTION methods to protect against these emerging threats. Presented by Patrick Wardle, this 43-minute talk provides a comprehensive overview of Office drama on macOS, filling a gap in research and security community attention.

Intro
OUTLINE
MACROS
ANALYSIS
SANDBOX BYPASS
QUARANTINED / NOTARIZATION
FULL EXPLOIT CHAIN
DETECTION