NotDoor Insights: Deep Dive into Outlook Macros and Beyond

Summary

This article examines the NotDoor backdoor, which abuses malicious Outlook VBA macros to maintain persistence and provide command-and-control. The payload is delivered via DLL sideloading of a tampered SSPICLI.dll that impersonates a legitimate OneDrive.exe binary. Obfuscated PowerShell scripts handle data exfiltration via webhook services and tweak Outlook registry settings to force macro execution. Detection guidance centers on tracking suspicious file creation, DLL loading activity, registry changes, and encoded PowerShell commands.

NotDoor Backdoor Analysis

Further analysis reveals that the rogue DLL creates a temporary directory, writes a payload into the Outlook VBAProject.OTM file, and configures registry keys to allow all macros. It then runs base64-encoded PowerShell instructions that issue DNS and HTTP callbacks to webhook.site and dnshook.site. Registry changes include enabling LoadMacroProviderOnBoot, lowering the Outlook security level, and modifying PONT_STRING to suppress security prompts.

Mitigation

Key mitigations include limiting DLL sideloading opportunities, enforcing code-signing requirements for executables, monitoring the creation of VBAProject.OTM by non-Outlook processes, and blocking outbound connections to the identified webhook domains. Additionally, teams can apply least-privilege principles to registry modifications and disable automatic macro loading wherever feasible.

Response

When NotDoor activity is detected, isolate the compromised endpoint, acquire the malicious DLL and related payloads, and perform a forensic review of registry edits and network traces. Block associated domains and IPs, launch a wider hunt for similar DLL sideloading behaviors, reset Outlook macro policies, and verify that all users’ security settings are brought back into a hardened state.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An attacker who has obtained user-level execution on the victim machine deploys the NotDoor malware. The malware’s goal is to ensure Outlook automatically loads a malicious macro on system startup, disables security warnings, and suppresses dialog pop‑ups. To achieve this, the attacker writes three specific registry values under the Outlook hive:

  1. LoadMacroProviderOnBoot set to 1 under HKCU\Software\Microsoft\Outlook – forces Outlook to load the macro provider each boot.
  2. Level set to 1 under HKCU\Software\Microsoft\Outlook\Security – lowers the macro security level.
  3. PONT_STRING set to a malicious CLSID under HKCU\Software\Microsoft\Outlook\Options\General – points Outlook to the malicious macro DLL.

  These writes generate Registry‑Change events that satisfy selection1 and (selection2 or selection3) in the Sigma rule, causing the alert to fire.

• Regression Test Script:

  # NotDoor registry modification simulation – PowerShell
  function Set-NotDoorOutlookRegistry {
      # 1. Enable macro provider on boot
      New-ItemProperty -Path "HKCU:\Software\Microsoft\Outlook" `
          -Name "LoadMacroProviderOnBoot" -Value 1 -PropertyType DWORD -Force
  
      # 2. Lower security warning level
      New-ItemProperty -Path "HKCU:\Software\Microsoft\Outlook\Security" `
          -Name "Level" -Value 1 -PropertyType DWORD -Force
  
      # 3. Point to malicious macro (simulated CLSID)
      $maliciousClsid = "{12345678-1234-1234-1234-123456789ABC}"
      New-ItemProperty -Path "HKCU:\Software\Microsoft\Outlook\Options\General" `
          -Name "PONT_STRING" -Value $maliciousClsid -PropertyType String -Force
  }
  
  # Execute the simulated attack
  Set-NotDoorOutlookRegistry

• Cleanup Commands:

  # Remove the simulated NotDoor registry modifications
  Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Outlook" `
      -Name "LoadMacroProviderOnBoot" -ErrorAction SilentlyContinue
  
  Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Outlook\Security" `
      -Name "Level" -ErrorAction SilentlyContinue
  
  Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Outlook\Options\General" `
      -Name "PONT_STRING" -ErrorAction SilentlyContinue