oletools
oletools copied to clipboard
olevba, oleid: add detection for CustomXML parts
See https://inquest.net/blog/2022/10/03/hiding-xml for an example of VBA macro using CustomXML to store a payload.
Also a new keyword ActiveDocument.CustomXMLParts to be added: https://learn.microsoft.com/en-us/office/vba/api/Office.CustomXMLParts
Another sample & vba snippet worth taking a look ¯_(ツ)_/¯
https://github.com/mgeeky/CustomXMLPart