Office Drama on macOS (Q&A)
Patrick Wardle answers questions on macOS malware heuristics, Microsoft Office sandbox escapes on macOS, and behavioral detections.
Summary
In this live Q&A session from the DEF CON Safe Mode Main Stage, macOS security specialist Patrick Wardle answers questions about weaponizing Microsoft Office for macOS to achieve code execution and persistence. Opening at 01:35, Patrick discusses the architectural differences between macOS and Windows Office suites, exploring the constraints of Apple's application sandbox.
At 07:03 and 13:00, he explains persistence techniques, demonstrating how abused Office macros and legacy launch agents allow attackers to establish silent foothold access across user logouts and reboots.
Concluding at 19:02 and 25:03, Patrick examines sandbox escape primitives, archive utility quirks, and endpoint detection strategies, demonstrating how defensive monitoring tools like BlockBlock and LuLu detect malicious macOS persistence artifacts. (AI summary — Gemini Flash)
Related talks
Main Stage·31 min
Patrick Wardle
Patrick Wardle analyzes emerging macOS macro-based Office malware campaigns, dissecting Apple sandbox escapes and synthetic click persistence tricks.
Main Stage·31 min
Bill Demirkapi
Bill Demirkapi answers community questions regarding modern Windows kernel development, PatchGuard interactions, and network driver hooks.
Main Stage·24 min
Peleg Hadar · Tomer Bar
Peleg Hadar and Tomer Bar discuss Windows Print Spooler architecture, local privilege escalation techniques, and spooler patch testing.