OneNote Malware Delivery Guide: Embedded File Lures and Microsoft Protections

OneNote notebooks can carry embedded files, and attackers used that feature to hide scripts and shortcuts behind a fake "double-click to view" button that users clicked through a single warning. OneNote malware delivery means sending a OneNote file (.one or a packaged .onepkg notebook) whose page contains an embedded attachment that runs code when opened. It surged in late 2022 and early 2023, after Microsoft's default blocking of internet macros and its fix for disk image Mark-of-the-Web bypasses closed the routes criminal groups had been using. Microsoft responded in 2023 by blocking embedded files with dangerous extensions in OneNote. This guide explains the lure, what Microsoft's protection does and does not cover, the policies and endpoint rules that close the remaining gaps, and how to detect attempts. It is for email security, endpoint and SOC teams, and it is strictly defensive.

Key takeaways

• The lure is an embedded file, not a macro. OneNote is not covered by Office's internet macro blocking or Protected View, which is why it was attractive once macros were blocked.
• Microsoft now blocks dangerous embedded extensions. From Version 2304 (Current Channel, May 2023) OneNote for Microsoft 365 blocks opening embedded files with the same dangerous extensions blocked by Outlook, Word, Excel and PowerPoint.
• The protection depends on version and policy. Devices on older builds or slower channels, and organisations that add extensions to the allow list, remain exposed.
• Most users never need a .one file from outside. Blocking .one and .onepkg attachments from external senders removes the route at low cost.
• Attack surface reduction rules cover OneNote by name. "Block all Office applications from creating child processes" explicitly includes OneNote, which stops the most common second step.

How the OneNote lure works

OneNote lets users embed any file on a page, shown as an icon. Embedded files are not sandboxed: double-clicking one hands it to Windows to open with its default handler. Before Microsoft's change, OneNote showed a generic warning that opening attachments could harm the computer, and the user could click OK.

• Delivery: a .one attachment or a link to one, usually in a thread-hijacked or invoice-themed email (T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link). OneNote files were also delivered inside archives.
• Lure page: a blurred image of a document with a large "Open" or "double-click to view file" button. The embedded files are hidden behind the image, so the click lands on them.
• Embedded payload: typically an HTML Application (.hta), a script (.js, .vbs, .wsf), a batch file (.cmd, .bat), a shortcut (.lnk) or an executable, which fetches and starts a loader.
• Execution: the user's click is the trigger (T1204.002 Malicious File), and the script host or proxy binary that runs it is a child of OneNote, which is the most reliable detection point.
• Outcome: commodity loaders and remote access tools. MITRE ATT&CK cites Trellix research published in March 2023 titled "Qakbot Evolves to OneNote Malware Distribution", and the wave was widely reported to include other loader and RAT families. See the Malware Loaders and Droppers Guide.

ATT&CK's mitigation guidance under T1559 Inter-Process Communication (M1054 Software Configuration) recommends considering disabling embedded files in Office programs, such as OneNote, that do not work with Protected View. That single line explains the whole problem: the safety net built for Word and Excel did not extend to OneNote.

Why OneNote replaced macros and disk images

See the Macro Malware Guide and the ISO and Container File Malware Delivery Guide for the earlier routes.

Microsoft's OneNote embedded file blocking

Microsoft documents the change on Microsoft Learn under "OneNote blocks embedded files that have dangerous extensions". Instead of a warning with an OK button, OneNote now blocks opening the embedded file and shows a dialog stating that the administrator has blocked that file type. A user who genuinely trusts a file can save it to the device and open it from there, where antivirus or Smart App Control may still intervene.

• Which OneNote: OneNote for Microsoft 365 and retail Office 2016, 2019 and 2021, plus volume-licensed Office LTSC 2019 and LTSC 2021, which follow the Current Channel schedule. OneNote on Mac, Android, iOS, the web and OneNote for Windows 10 are not affected by the change.
• Which extensions: by default the same dangerous extensions blocked in Outlook, Word, Excel and PowerPoint. Microsoft points to its Outlook blocked attachments list, which includes .hta, .js, .vbs, .wsf, .cmd, .bat, .ps1, .lnk, .exe, .scr, .msi, .url, .iso, .img and .vhd.
• Block more: the policy "Block additional file extensions for OLE embedding" under User Configuration\Policies\Administrative Templates\Microsoft Office 2016\Security Settings, or the Cloud Policy service. It also affects Word, Excel and PowerPoint.
• Allow some: the policy "Allow file extensions for OLE embedding" in the same location. Microsoft warns that adding extensions here makes OneNote and other applications less secure.
• Licensing: both policies require Microsoft 365 Apps for enterprise and are not available for Microsoft 365 Apps for business.
• Policy to avoid: Microsoft advises against using the OneNote-specific "Embedded Files Blocked Extensions" policy for this purpose.

Defences beyond the built-in block

Email and collaboration

• Block or quarantine .one and .onepkg from external senders: in Microsoft Defender for Office 365 the common attachments filter lists "one" among the additional file types, not the defaults, so it must be added explicitly. Cover .onepkg with a mail flow rule if your filter does not list it.
• Detonate the rest: Safe Attachments in Block mode, with zero-hour auto purge, detonates attachments before delivery and removes ones later found malicious. Apply equivalent features if you use another gateway. See the Email Security Guide.
• Archives: OneNote files nested in archives evade an extension filter on the outer file. Inspect archive contents and decide policy for password-protected archives.
• Shared notebooks: internal notebooks on SharePoint or OneDrive are normal business use and should not be blocked; Safe Attachments for SharePoint, OneDrive and Teams covers files uploaded there. See the SharePoint and OneDrive Security Guide.

Endpoint

See the Microsoft Defender for Endpoint Guide and the Application Allowlisting Guide.

Choosing your approach

• Built-in block only: adequate for organisations on Current Channel or Monthly Enterprise Channel that never allow additional extensions, but it relies on every device being current and on the default list matching what attackers use.
• Built-in block plus gateway block: the right default for most organisations. External OneNote attachments are rare, and blocking them also protects devices on older builds.
• Add extensions with the block policy: consider blocking further types used by your own threat intelligence, for example archive or document types that you never expect to be embedded. Test against internal notebooks first, as the policy also applies to Word, Excel and PowerPoint.
• Small organisations: keep Microsoft 365 Apps on Current Channel, block .one from external senders, and enable the Office child process ASR rule. That is a short piece of work with strong effect.
• Large organisations: add a version compliance report for OneNote, ASR enforcement in rings, application control, and detection content for OneNote child processes. Review every request to use the allow policy through change control.
• Microsoft 365 Apps for business: the OLE embedding policies are not available, so rely on current builds, gateway blocking and ASR.

Rolling out the controls

1. Inventory versions: report OneNote and Microsoft 365 Apps versions and channels across the estate; flag devices below 2304 (or 2302 on Semi-Annual Extended) and devices running unsupported Office versions.
2. Measure the need: review 90 days of mail for .one and .onepkg attachments by sender. Most organisations see almost none from legitimate external senders.
3. Block at the gateway: add one and onepkg to the attachment filter for external mail, with an exception process. Roll back by removing the extension.
4. Check the OLE policies: confirm no device has extensions added to "Allow file extensions for OLE embedding" without a recorded business reason.
5. Audit ASR: run the Office child process rule in audit for two to four weeks, review events with owners of Office add-ins, and add narrow exclusions only for named, signed tools.
6. Enforce in rings: pilot ring, then broad. Roll back a single rule to audit if a business process breaks, rather than disabling ASR.
7. Train with the real lure: show users the fake "double-click to view" image and the new block dialog, and tell them how to report it. See the Security Awareness and Human Risk Management Guide.

Detection and measurement

Metrics that show the programme is working:

• Version compliance: percentage of Windows devices with OneNote on a build that includes the embedded file block.
• Gateway coverage: percentage of external mail subject to the OneNote attachment policy.
• ASR enforcement: percentage of devices with the Office child process rule in block mode, and the number of exclusions.
• Allow list exceptions: number of extensions added through the allow policy, which should be zero or individually justified.
• Report rate: share of OneNote lures that reach mailboxes and are reported by users before any execution.
• Time to contain: median time from a OneNote child process alert to host isolation and credential reset.

Where identity fits

The loaders and remote access tools delivered through OneNote typically go on to steal browser credentials and session cookies. Treat a confirmed execution as a credential incident: reset the user's password, revoke sessions and refresh tokens, and review any API keys or tokens the user can reach. Removing standing local administrator rights limits what the payload can change. See the Malware Guide.

Framework mapping

Common failure patterns

• Assuming macro blocking covers OneNote: it does not. Microsoft's internet macro block lists Access, Excel, PowerPoint, Project, Publisher, Visio and Word only.
• Slow update channels: devices on Semi-Annual Enterprise Channel received the block months after Current Channel, and unsupported Office versions may never receive it.
• Allow list creep: extensions added to "Allow file extensions for OLE embedding" to fix one workflow weaken OneNote, Word, Excel and PowerPoint for everyone in scope.
• Training users to save and open: the documented workaround for trusted files is exactly what a persuasive lure asks for. Users need to know that a blocked embedded file from an external email should be reported, not saved.
• Office ASR rules left in audit: the child process rule is the single most effective endpoint control here, and audit mode does not block.
• Forgetting the second stage: once a loader runs, the problem is no longer OneNote. Hand over to the malware and credential playbooks quickly.

Practitioner checklist

• Keep Microsoft 365 Apps on a channel and build that includes the OneNote embedded file block, and report on stragglers.
• Block or quarantine .one and .onepkg attachments from external senders, including inside archives where your gateway can inspect them.
• Audit "Allow file extensions for OLE embedding" settings and remove unjustified entries.
• Use "Block additional file extensions for OLE embedding" for extra types your threat intelligence supports, after testing.
• Enforce the ASR rule "Block all Office applications from creating child processes" after an audit period.
• Reassociate script file types with a text editor and deploy application control for standard users.
• Alert on OneNote spawning script hosts, shells or proxy binaries.
• Show users the real lure and block dialog in awareness material, and make reporting easy.
• Include credential reset and token revocation in containment for any OneNote-delivered execution.

Standards and references

• Microsoft Learn: OneNote blocks embedded files that have dangerous extensions
• Microsoft Learn: Attack surface reduction rules reference
• Microsoft Learn: Macros from the internet are blocked by default in Office
• Microsoft Learn: Anti-malware protection in EOP
• Microsoft Learn: Safe Attachments in Microsoft Defender for Office 365
• Microsoft Support: Blocked attachments in Outlook
• MITRE ATT&CK: User Execution: Malicious File (T1204.002)
• NCSC: Mitigating malware and ransomware attacks

Related NHI Mgmt Group resources: Malware Guide · Macro Malware Guide · Malicious LNK Files Guide · HTML Smuggling Guide · ISO and Container File Malware Delivery Guide