An attachment is data, but some data is also instructions. A document can contain a macro, an archive can hide a file from a scanner, and a disk image can present a program as if it were a folder. Attackers use these formats because people open them as part of normal work, and because each one gives a different opportunity to run code or to avoid inspection. This article covers the main categories, why they are used, and how to handle them.
Executables and scripts
Native executables such as .exe, .com, .scr and .msi run directly when opened. Script files such as .js, .vbs, .bat, .cmd, .ps1 and .lnk are interpreted or launched by the system. Some of these, such as a shortcut file, can point at a program or a command line elsewhere. The attacker's goal is simply to get the operating system to execute their code once the user opens the file.
Attackers often disguise these files with double extensions, such as invoice.pdf.exe, relying on Windows hiding known extensions by default. Some use an invisible right-to-left character in the file name so that the real extension appears to be somewhere else. Showing all file extensions in the operating system's settings makes both tricks visible.
Macro-enabled Office documents
Word, Excel and PowerPoint can store macros in documents with names such as .docm, .xlsm and .pptm. Macros are small programs written in VBA. They are useful in legitimate workbooks, which is why the feature exists, and they are dangerous when a document arrives unexpectedly and asks to enable content. The typical lure is a message that says the document is protected and must have editing enabled.
Current versions of Office block macros in files that carry the internet Mark of the Web and offer a banner instead, which removes much of the risk for files from outside. Other paths remain, such as files that have had the mark removed by an archive tool or a sync client. Treat any request to enable content in an unexpected document as suspicious.
Archives
ZIP, RAR, 7z and similar archives are often used to carry one of the other categories. The archive hides the payload's true contents from a gateway that does not unpack it, or unpacks only to a limited depth. Password-protected archives are the most difficult case, because the content cannot be inspected at all without the password, and the password is sent in the message body or a separate message to get past the check.
A common pattern is an archive containing a single executable or script with a name meant to look like a document. The archive is the lure, and the file inside is the actual threat.
Disk images
ISO, IMG, VHD and VHDX files are disk images. Windows can mount some of them as drives, which makes them look like a folder of ordinary files. Attackers have used disk images to carry executables and shortcut files past filters that were tuned for archives. Scanners do not always inspect their contents, so treat an unexpected disk image as high risk.
Why these formats are used
- They are expected. Invoices, reports, forms and installers are common attachments, so a dangerous file blends in.
- They hide content. Archives and passwords defeat inspection, and disguised names defeat casual review.
- They use trusted paths. Office and the operating system do the work of running the code, so the attacker needs little beyond the file.
- They are cheap. Creating a macro document or an archive takes minutes, which makes campaigns easy to repeat.
Handling them
- Block executables at the gateway for inbound mail, and make exceptions only through a documented process.
- Decide policy for macros. Disable macros by default, allow signed macros from known sources where needed, and do not allow macros from mail.
- Inspect archives by content. Detect the real file type from its contents, not its extension, and treat nested archives and encrypted archives as higher risk.
- Consider stripping or converting risky attachments for users who do not need them, and deliver a safe copy instead.
- Use sandboxing for files that must be opened, where the organization has the tooling for it.
- Show extensions on endpoints so disguised names are visible.
For users
If you do not expect an attachment, verify the sender through another channel before opening it. Do not enable content in a document that asks you to, and do not run a file from an archive you did not request. If you need to share an executable or macro-enabled file, use a link to a known location rather than an attachment, and tell the recipient what it is.
Filtering on ITProMail
Filtering rules on your mailbox can route suspicious attachments into a separate folder for review. The Sieve guide describes how filtering works, and the Sieve examples include patterns for sorting mail. Filtering supplements judgment and does not replace it. For reporting abuse of an address or a domain, contact support.