# Malicious Office Macro Detection: Combined Features with Obfuscation and Suspicious Keywords
## 1 Introduction  
Dealing with Office documents has become an integral part of work in the digital era. Unfortunately, it has become a common tactic for attackers to carry out cyberattacks using malicious documents. A typical approach is that an attacker crafts a malicious document that exploits a vulnerability or contains a malicious macro. They then add the document as an email attachment and send the email to the target. Since Office documents are often perceived as non-threatening, there is a high probability that the target will open the malicious document. However, continuous improvements in platforms and applications have significantly mitigated malicious activities, while attacks based on social engineering and macro abuse have surged in the past decade [1]. To counteract this threat, Microsoft introduced the Antimalware Scan Interface (AMSI) in 2018. This interface enables antivirus security solutions to scan macros and other scripts at runtime. It has also been integrated into the new version of the Office 365 client application. Last year, Microsoft Office implemented a proactive measure by blocking macros from the internet. This action resulted in a 66% reduction in macro-based attacks over an eight-month period. However, as attackers refine their techniques to bypass this mechanism, macro-based Office documents still pose a security threat. Security researchers have observed that attackers have been increasingly utilizing alternative document formats, such as Publisher files and OpenDocument text (.odt) files, to conduct phishing attacks. These formats may still execute macros, but they can bypass the latest security controls. Despite this, several Advanced Persistent Threat (APT) groups, such as Kimsuky, Donot, and SideCopy, as well as cybercriminals like Emotet, continue to rely on macro-based Office documents to launch attacks and distribute their malicious payloads. Current research focuses on detecting malicious macros by examining macro obfuscation and suspicious keywords, such as specific strings and functions. Both methods have limitations. Obfuscation detection is unable to distinguish between the obfuscation ofbenign or malicious macros, resulting in numerous false positives in detection [2]. The latter detection method relies on the knowledge of security experts regarding known suspicious keywords and has been proven to be incapable of detecting new attack patterns. In fact, the aforementioned approaches appear to complement each other. Obfuscation is often necessary for malicious macros, regardless of the attack techniques used. Therefore, obfuscation detection can be employed to identify unknown malicious macros. On the other hand, detection based on suspicious keywords can capture known malicious characteristics of macros. However, the two types of features mentioned above have never been combined to identify malicious macros in previous research. Based on the above observations, this paper conducts an objective analysis by extracting features of obfuscation and suspicious keywords and integrating them to detect malicious macros. First, 123 features are thoroughly extracted from obfuscation and suspicious keywords. Second, four widely used machine learning models are trained to detect malicious macros. Our proposed method is evaluated on two datasets: Dataset1, a public dataset, contains 2939 benign samples and 13,734 malicious samples. Dataset2 consists of 2885 new samples from Virustotal, all of which were reported after the publication date of Dataset1. The experiments conducted on Dataset1 reveal that the adjusted model with combined features achieves the highest F1-score of 0.997. Employing this classifier to detect malicious samples from Dataset2 achieves a detection rate of 95.3%. Comparing the detection of macros using a single type of feature, the classifier with combined features achieves better performance. Further analysis shows that conducting ensemble training could further improve the detection performance.