Looking for a tool that can scan the entire PC for macros

[yogjeet]

Hi guys,

We are looking for a tool for our organization which can be run on an individual computer (like an anti-virus scan) and can identify all Office macro-enabled files on that PC.

The overall aim is to run it remotely on all organization machines and identify all macro enabled files.

Thanks for the help.

[decalage2]

Well, with the current oletools I see two ways to do it:

1. Run olevba in triage mode (-t), with -r to scan dirs recursively: olevba -r -t path\*.*
   All files with macros will be shown with "M" in the flags on the left, as shown here.
   The problem is that any text or unrecognised file may also be shown with a M, because olevba analyses them as potential VBA source code. To avoid those false positives, I would recommend just to filter out any line starting with "TXT".

2. Create a simple python script to crawl all the files on a PC, then call VBA_Parser.detect_macros as described here. With detect_macros you get both VBA and XLM macros, if you need only VBA then use detect_vba_macros. It might be a good idea to check the first bytes of each file to make sure it's either OLE or Zip before feeding it to VBA_Parser.

[yogjeet]

Thanks for the quick reply! I will discuss the same with our tech team