What We Do
How we do it
Resources
SECURITY ADVISORIES
Sep 23, 2021
SolarMarker Malware Activity
THE THREAT eSentire has observed a recent and significant increase in SolarMarker infections delivered through drive-by download attacks. These attacks rely on social engineering techniques to persuade users to execute malware disguised as document templates. SolarMarker is a modular information-stealing malware; infections may result in the theft of sensitive data including user credentials.…
Read More
View all Advisories →
Company
ABOUT eSENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1000+ organizations in 70+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
Aug 25, 2021
eSentire named a Leader in IDC MarketScape for U.S. Managed Detection and Response Services
August 26, 2021 – Waterloo, ON -  eSentire, recognized globally as the Authority in Managed Detection and Response (MDR), announced today that it has been named a Leader in the IDC MarketScape: U.S. Managed Detection and Response Services 2021 Vendor Assessment (doc #US48129921, August 2021). IDC defines the core services an MDR must provide as follows: reduced time for onboarding, 24/7…
Read More
Partners
PARTNER PROGRAM
Partners
Our award-winning partner program offers financial rewards, sales and marketing tools and personalized training. Accelerate your business and grow your revenue by offering our world-class Managed Detection and Response (MDR) services.
Learn about our Partner Program
Search
Resources
Blog — Aug 31, 2021

Using a Machine Learning Threat Detection Model to Extract and Classify Malicious Macros

Threat actors have long relied on the use of macros to create malicious documents that are emailed to unknowing victims as part of an overall phishing campaign. Once the document is opened, the malicious macros are executed, providing an initial access point for threat actors to leverage.

In Verizon’s 2020 Data Breach report, researchers state that 94% of malware is delivered through email and in 45% of the cases, the malware is hidden in Microsoft Office documents. If organizations have a strong security awareness training program in place, they can train their employees to spot common signs (e.g., spelling errors and complicated instructions for the attached Microsoft Office documents) that an email may be malicious.

Additionally, if the organization has engaged a security provider with a security operations center (SOC), the SOC analysts may leverage machine learning (ML) to detect malicious files proactively.

However, adversaries have begun to use sophisticated anti-detection techniques such as Macro stomping, wherein the original Visual Basic application (VBA) code is removed but the compiled payload is left untouched.

To curb this rising threat, eSentire partnered with the University of Guelph’s Cyber Science Lab for a research project on the “Detection of malicious documents by extracting and interpreting macros in Microsoft Office files”.

This partnership brings together large volumes of unlabeled customer data and compute resources, along with mentorship from University of Guelph faculty to provide students with the opportunity to perform security research and develop world-class machine learning algorithms to provide solutions to reduce business risk.

“Collaboration between companies and universities play a significant role in transferring knowledge and creating jobs for Canadians. Cyber Science Lab at the University of Guelph and eSenitre enjoy a long-lasting collaboration resulting in many interesting projects in cyber threat intelligence and threat hunting,” Ali Dehghantanha, Director of the Cyber Science Lab, says.

Edward Crowder, a student enrolled in the Master of Cyber Security and Threat Intelligence program, has been working with eSentire’s Threat Response Unit (TRU) team to use artificial intelligence (AI) as a solution to extract and analyze macros and determine their indent and potential for malicious code execution.

“Edward's project stands out as one of the best examples of using accurate machine learning models to hunt for macro-based malware - a technique that is commonly used during delivery of attack payloads by advanced adversaries,” Deghantanha explains.

The objectives of the project are twofold:

Overall, the project was a resounding success. Edward, along with eSentire’s security researchers, were able to achieve high 90% average accuracy on the deep learning models, showing high confidence and correlation like human-level static analysis.

“Edward's technical achievement is impressive. He has created a highly accurate machine learning model to detect malicious office macros used in real-world attacks,” Rob McLeod, Vice President, Threat Response Unit (TRU), says. “This model provides differentiated threat detection capabilities to provide additional protection and detection capabilities to eSentire's customers.”

To learn more about the partnership between University of Guelph and eSentire, click here.

eSentire
eSentire

eSentire is the Authority in Managed Detection and Response, protecting the critical data and applications of 1000+ organizations in 70+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events. Combining cutting-edge machine learning XDR technology, 24/7 Threat Hunting, and proven security operations leadership, eSentire mitigates business risk, and enables security at scale. The Team eSentire difference means enterprises are protected by the best in the business with a named Cyber Risk Advisor, 24/7 access to SOC Cyber Analysts & Elite Threat Hunters, and industry-leading threat intelligence research from eSentire’s Threat Response Unit (TRU). eSentire provides Managed Risk, Managed Detection and Response and Incident Response services. For more information, visit www.esentire.com and follow @eSentire.