ScanOnenote Scanner

[phutelmyer]

Describe the change
Microsoft OneNote, included in Microsoft Office 2019 and Microsoft 365, is a note-taking and collaboration tool.

The OneNote documents themselves can contain embedded files, like executables, images, or compressed files. In some malware campaigns, threat actors have been observed hiding redirect code behind an image that looks like a button, and upon clicking the image, the file will execute. The file might be different kinds of executables, shortcut (LNK) files, or script files such as HTML application (HTA) or Windows script file (WSF).

This change provides Strelka with the ability to identify and extract files from Onenote files (.one and .onepkg files). Given a OneNote file, Strelka will extract subfiles, which are then placed back into the Strelka pipeline for processing. This can be useful for identifying anomalous files inside of OneNote files, such as scripts.

Describe testing procedures
Malicious OneNote samples as well as test files (src/python/strelka/tests/fixtures/test.one and src/python/strelka/tests/fixtures/test.onepkg) were tested against this scanner. Observed events include the OneNote file itself (which holds no metadata at the moment) as well as child files of that OneNote file.

============================= test session starts ==============================
platform linux -- Python 3.10.6, pytest-7.2.0, pluggy-1.0.0
rootdir: /strelka
plugins: unordered-0.5.2, mock-3.10.0
collected 104 items
...
tests/test_scan_ole.py ....
tests/test_scan_onenote.py ..
tests/test_scan_pcap.py ..
...
====================== 104 passed, 26 warnings in 58.50s =======================

Sample output

You can observe anomalous files using this scanner by exploring events with the key file.source of ScanOnenote. This key implies that the event is a child of a file identified and scanned with the OneNote scanner. An example of this can be seen below:

Parent OneNote File Sample
Shows that a OneNote file was identified and ScanOnenote was executed against that file.

{
  "file": {
    "depth": 0,
    "flavors": {
      "mime": [
        "application/octet-stream"
      ],
      "yara": [
        "onenote_file"
      ]
    },
    "name": "REMOVED",
    "scanners": [
      "ScanEntropy",
      "ScanFooter",
      "ScanHash",
      "ScanHeader",
      "ScanOnenote",
      "ScanYara"

    **"onenote": {
      "elapsed": 0.015488
    },**
    "yara": {
      "elapsed": 0.043428,...
  ...
}

Child Script File
Shows that a OneNote file was the source of this file and appropriate scanners were run against this file (as this is a Batch file, ScanBatch was ran against this. Batch files are atypical child files of OneNote notebooks.

{
  "file": {
    **"depth": 1,**
    "flavors": {
      "mime": [
        "text/x-msdos-batch"
      ]
    },
    "name": "REMOVED",
    "scanners": [
      "ScanBatch",
      "ScanEntropy",
      "ScanFooter",
      "ScanHash",
      "ScanHeader",
      "ScanYara"
    ],
    "size": 50582,
    "source": "ScanOnenote",
    "tree": {
      "node": "a7d027b7-99a5-4314-bd3e-95a4f6ea978f",
      "parent": "e1e46b15-accc-48f6-99a9-7918e74acdd7",
      "root": "e1e46b15-accc-48f6-99a9-7918e74acdd7"
    }
  },
  **"scan": {
    "batch": {
      "elapsed": 0.024035,
      "strings": [
        "WUoV=set",
        "OjSRJIrFLn=ex",
        "MOJvZslwrv=Po",
        "cSdjTkwQXC=s\\\\",
        "RNnLdLhrkr=do",
        "wFVpokNJgI=rs",
      ...
      ]**
    }
  }
}

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of and tested my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings