VBA Stomping is a tampering technique where malicious Office macros remain in a document while the readable VBA source is removed or replaced with benign-looking content. Defenders should inspect macro-enabled files for mismatches between source and compiled macro streams and treat abnormal macro structures as suspicious.
What VBA Stomping Is
VBA stomping is a document tampering method, not a normal macro feature. The key idea is that the compiled macro code can still execute while the readable source shown to analysts has been stripped, replaced, or made to look harmless.
This matters because Office macro files can contain more than one view of the same logic: human-readable VBA source, compiled p-code or other internal macro streams, and document content that may look benign at a glance. When those layers do not agree, defenders should treat the file as suspicious and investigate the discrepancy rather than trusting the visible source alone.
How VBA Stomping Works in Malicious Documents
Attackers use this technique to hide what a macro really does after delivery. A document may appear to contain a harmless or empty macro project, while the executable macro stream still carries the malicious logic that runs when the user opens the file and enables content.
The defensive problem is that analysts and automated tools often rely on source inspection first. If the source has been removed or rewritten, a quick look at the VBA editor or extracted text can miss payloads, staging logic, or commands embedded in the compiled macro layer.
Malware Guide is a useful companion for understanding how macro abuse fits into broader malware tradecraft, including payload hiding, evasion, and analysis-resistant delivery.
Why VBA Stomping Is Dangerous
VBA stomping is dangerous because it weakens one of the most common analyst assumptions in Office malware triage, that visible macro source reflects actual behaviour. That false trust can delay detection, allow malicious attachments to pass through manual review, and give an attacker more time to reach execution, staging, or follow-on payload delivery.
It also increases the chance that a document will be misclassified as a low-risk macro file when it is actually a disguised malware container. In practice, the danger is not just concealment, it is concealment that exploits the gap between what a user or analyst can read and what the Office runtime can execute.
MITRE ATT&CK Enterprise Matrix helps place macro-based concealment within the wider attacker workflow of delivery, execution, and defense evasion.
How Defenders Detect and Verify It
Defenders should inspect macro-enabled files for mismatches between the source code and the compiled macro streams, not just for suspicious strings in the visible VBA. A file that contains inert-looking source but still carries executable macro content deserves deeper analysis with tooling that can expose internal structure, such as sandboxing, static triage, and file-format inspection.
Useful verification steps include comparing macro source with extracted internal streams, checking for abnormal or partially removed VBA projects, and correlating the document structure with runtime behaviour. The goal is to confirm whether the file’s readable layer matches the executable layer before deciding it is safe.
NIST SP 800-53 Rev 5 Security and Privacy Controls is relevant here because macro inspection, system integrity checks, and malicious-code analysis map to standard defensive control families.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | Enterprise Matrix | Maps macro concealment to adversary delivery and defense evasion techniques. |
| Recommendation — Map suspicious macro files to ATT&CK and investigate delivery, execution, and evasion techniques. | ||
| NIST SP 800-53 Rev 5 | SI-3 — Malicious Code Protection | Macro tampering is a malicious-code hiding problem that requires inspection and blocking controls. |
| SI-7 — Software, Firmware, and Information Integrity | VBA stomping creates source-versus-executable integrity mismatches in documents. | |
| Recommendation — Apply SI-3 to detect and block malicious macro content hidden in Office files. Use SI-7 to verify document integrity and flag mismatched macro structures. | ||
Practitioner Guidance
What to watch for: Treat any Office file with macros as suspect when the visible VBA looks empty, truncated, or unrelated to the document’s behaviour. That mismatch is often the strongest indicator that the source view has been tampered with and that the file needs deeper inspection before it is opened broadly or allowed to execute.
Practitioner takeaway: Do not trust source code alone in macro analysis, trust the relationship between source, compiled macro content, and observed behaviour.