Sophisticated malware uses "VBA Stomping" (also known as VBA Purge). The attacker removes the parsed VBA code (the ProjectStream) but leaves the unparsed source code (CompressedSourceCode). Most antivirus scans the ProjectStream, finding nothing. IDSxls allows you to view the raw streams directly. If you see a CompressedSourceCode stream but no ProjectStream, you have identified stomped macros.
Why do people use this method?
Use Windows Task Scheduler, cron jobs, or cloud functions to trigger IDSXLS work at regular intervals.
To ensure your IDSXLS work is sustainable, maintainable, and audit-friendly, follow these best practices.