Researcher chains CVE-2019-1457 to bypass macOS notarization
A researcher built a full exploit chain from a patched Office macro bug, a new sandbox escape, and a notarization bypass to silently and persistently backdoor fully-patched macOS Catalina.
Sourceobjective-see.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
This is a Defcon talk writeup from Objective-See detailing both in-the-wild macOS macro-based attacks and a novel proof-of-concept exploit chain. The author first reviews three real-world campaigns (2017-2019) that used malicious Office macros on macOS to deploy the EmPyre post-exploitation agent and, in the case of the Lazarus Group, a custom binary implant fetched from nzssdm[.]com. These in-the-wild attacks are described as largely neutered by existing mitigations: macro warning prompts, application sandboxing, and Catalina's notarization checks.
The core of the talk is a researcher-constructed exploit chain that defeats all three mitigations. It begins with CVE-2019-1457, a Microsoft Office SYLK/XLM macro auto-execution flaw (originally discovered by Pieter Ceelen and Stan Hegt) that fires without any user prompt when 'Disable all macros without notification' is set. From there, the researcher chains a new sandbox escape — abusing macOS's ability to persist a Login Item from within the sandboxed Office process — with a creative notarization bypass: persisting a zip archive as a login item, which Archive Utility auto-extracts outside the sandbox, silently dropping a Launch Agent that spawns an interactive reverse shell via /bin/bash (a trusted, already-notarized system binary). The result is full, alert-free, persistent compromise of a fully patched macOS Catalina system triggered solely by opening a malicious document, demonstrated by installing a repurposed OSX.WindTail backdoor via the resulting shell.
Microsoft patched the macro auto-execution issue as CVE-2019-1457 and attributed the remaining sandbox/notarization issues to Apple; Apple silently fixed the bugs in macOS 10.15.3 without assigning a CVE. The author closes by showing that behavior-based heuristics — monitoring for Office applications spawning child processes (curl, python) and monitoring persistence locations such as Login Items and Launch Agents — can generically detect both the in-the-wild attacks and this novel exploit chain.
Mentioned in this report
Detection guidance
Office Application Spawning Shell Interpreter or Download Tool
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Microsoft Office process (Word/Excel) spawning curl, python, or /bin/bash - indicative of macro-based payload execution or reverse shell establishment. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Office Application Spawning Shell Interpreter or Download Tool
description: Detects Microsoft Office applications (Word, Excel, PowerPoint) on macOS
spawning shell interpreters or download utilities such as curl, python, or bash.
Typical of macro-based malware executing payload code or establishing interactive
shells.
tags:
- attack.execution
- attack.t1105
- attack.t1059.005
logsource:
category: process_creation
product: macos
detection:
selection:
ParentImage|endswith:
- /Microsoft Word
- /Microsoft Excel
- /Microsoft PowerPoint
Image|endswith:
- /curl
- /python
- /bash
- /sh
filter_legitimate_macros:
CommandLine|contains:
- help
- --version
condition: selection and not filter_legitimate_macros
falsepositives:
- Office add-ins that legitimately shell out to download or execute scripts
- User-authored macros in trusted environments that invoke system utilities
level: high
id: 38d14570-3759-52be-9470-bff67143b668
status: experimental
author: Vorant
Persistence via Office-Spawned Login Item Registration
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Microsoft Office process registering a Login Item (via defaults or LaunchServices) to persist code execution across reboots. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Persistence via Office-Spawned Login Item Registration
description: Detects Microsoft Office applications spawning processes that register
Login Items or modify LaunchServices preferences. Office macro sandbox escapes often
abuse the ability to add Login Items, persisting ZIP archives or shell scripts that
execute on login.
tags:
- attack.persistence
- attack.t1547.015
logsource:
category: process_creation
product: macos
detection:
selection_defaults:
ParentImage|endswith:
- /Microsoft Word
- /Microsoft Excel
- /Microsoft PowerPoint
Image|endswith: /defaults
CommandLine|contains:
- write com.apple.loginitems
- LSSharedFileListItemData
selection_launchctl:
ParentImage|endswith:
- /Microsoft Word
- /Microsoft Excel
- /Microsoft PowerPoint
Image|endswith: /launchctl
CommandLine|contains: load
condition: 1 of selection_*
falsepositives:
- Office add-in installers that register their own helper utilities as Login Items
level: high
id: 6c194881-00cf-5ec1-a386-1fba1cf8427b
status: experimental
author: Vorant
Launch Agent Creation from Extracted Archive in Home Directory
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Creation of a Launch Agent plist in ~/Library/LaunchAgents following archive extraction, typical of notarization-bypass chains that unpack ZIP archives outside the sandbox. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Launch Agent Creation from Extracted Archive in Home Directory
description: Detects creation of Launch Agent property list files in ~/Library/LaunchAgents
directory. Combined with archive auto-extraction, this indicates a notarization
bypass chain where a ZIP archive persisted as a Login Item is auto-extracted by
Archive Utility outside the sandbox, dropping an unsigned Launch Agent that gains
persistence.
tags:
- attack.persistence
- attack.t1543.001
- attack.t1211
logsource:
category: file_event
product: macos
detection:
selection:
TargetFilename|contains: /Library/LaunchAgents/
TargetFilename|endswith: .plist
Image|endswith:
- /Archive Utility
- /ditto
- /unzip
- /tar
filter_apple_updates:
TargetFilename|contains: com.apple
condition: selection and not filter_apple_updates
falsepositives:
- Legitimate software installers that auto-extract and register Launch Agents
- User-initiated installation of third-party tools via DMG or ZIP
level: medium
id: 1fe310b2-a63a-5b3d-ad37-5939d65fc44a
status: experimental
author: Vorant
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x4B.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs, actors, and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs