OneNote Malware Trends - Understanding Process Activity with ProcMon

Understanding process activity can provide valuable insights where looking for malicious activity or creating rules to block it. With the recent surge in OneNote based malware, the the trend has been to use a variety of embedded scrips or even PE files to gain initial access. In this video, we'll cover a lot of ground by investigating how OneNote documents lure users into executing the malicious code. We'll observe process activity using Process Monitor and Process Hacker. Then use onedump …

access block code documents embedded files initial access insights malicious malware onenote process procmon rules trend trends understanding video