olevba, oleid: add detection for CustomXML parts
decalage2 opened this issue · 1 comments
decalage2 commented
See https://inquest.net/blog/2022/10/03/hiding-xml for an example of VBA macro using CustomXML to store a payload.
Also a new keyword ActiveDocument.CustomXMLParts to be added: https://learn.microsoft.com/en-us/office/vba/api/Office.CustomXMLParts
mgeeky commented
Another sample & vba snippet worth taking a look ¯_(ツ)_/¯