# Office And Script Playbook

Load this playbook for OLE, OOXML, RTF, VBA, VBS, VBE, JS, JSE, HTA, WSF, WSH, PowerShell, BAT, CMD, and script droppers.

## Tools

Preferred: `file`, hash tooling, `strings`, `rg`, `7z`, `unzip`, `zipinfo`, `exiftool`, `oletools` (`oleid`, `olevba`), `oledump.py`, `rtfobj`, `python3`, `xxd`, `base64`, `sed`, `awk`, `tr`, `iconv`.

Useful: `pwsh`, `node`, CyberChef CLI, beautifiers, AST parsers. Use runtimes only for safe parsing or decoder emulation on inert data, never to execute the malicious script as-is.

Ask before installing missing blocking tools.

## Workflow

1. Identify container: OLE, OOXML zip, RTF, plain script, encoded script, shortcut-like wrapper, archive, or mixed content.
2. For OLE/Office, run `oleid`, `olevba`, `oledump.py`; inspect streams, macros, forms, embedded objects, external relationships, templates, and DDE.
3. For OOXML, inspect XML, relationships, embedded objects, macros, external template references, hyperlinks, custom XML, and package parts.
4. Identify auto-execution triggers: `AutoOpen`, `Document_Open`, `Workbook_Open`, `AutoClose`, event handlers, `On Error Resume Next`, scheduled tasks, registry run keys, startup folders.
5. Search dangerous primitives: `CreateObject`, `GetObject`, `Shell`, `Run`, `Exec`, `Eval`, `Execute`, `WScript.Shell`, `MSXML2.XMLHTTP`, `WinHttpRequest`, `ADODB.Stream`, `PowerShell`, `IEX`, `DownloadString`, `WebClient`, `Start-BitsTransfer`, `certutil`, `bitsadmin`, `mshta`, `rundll32`, `regsvr32`, `curl`, `wget`.
6. Reconstruct obfuscation: `Chr`/`ChrW`, numeric arrays, split/join/replace, reversed strings, percent/hex escapes, Base64, UTF-16LE, XOR, simple substitution, compression, environment-variable concatenation, staged command lines, and encoded PowerShell.
7. Extract URLs, domains, IPs, Telegram/API artifacts, paste/GitHub/raw/cloud URLs, payload filenames, commands, registry paths, scheduled tasks, and persistence.
8. Preserve original macro/script, normalized script, decoded commands, decoder scripts, extracted embedded payloads, and stage relationships.
9. If remote retrieval is authorized, download using the parent script's exact method, parameters, headers, filenames, and post-download transform, then analyze as a new stage.

## Edge Cases And Anti-Loop Rules

- Follow the core Token Budget And Anti-Loop Mode.
- Never execute macros, scripts, encoded PowerShell, HTA, WSF, or LOLBins directly.
- If OLE/OOXML parsing fails, switch tools or inspect streams, relationships, archives, strings, or raw carved data.
- Do not call a decoded command or URL final until the full concatenation/decode chain is reconstructed or the limit is documented.
- Preserve parent headers, method, parameters, filename, and post-download transform for authorized stage retrieval.

## Report Requirements

Include document/script type, macro or script entry point, deobfuscation chain, final command line, C2/drop/stage URLs with origin, LOLBins, downloaded or embedded stages with hashes, persistence, family/toolkit candidates, confidence, and limits. If no C2 is found, state whether it is likely runtime-built or absent.