OneNote Embedded file abuse

In recent weeks OneNote has gotten a lot of media attention as threat actors are abusing the embedded files feature in OneNote in their phishing campaigns.
In this post we will analyze this new way of malware delivery and create a detection rule for it.

abuse abusing attention campaigns cyber threats delivery detection detection engineering embedded file files maldoc malware media onenote phishing qakbot qbot reverse engineering threat threat actors threat hunting yara