Learn
active
SANS ISC: Extracting Embedded Files from OneNote (.one) Files
- Engineer — Learn: OneNote has been abused as a malware delivery vector; knowing how to extract embedded objects from .one files is useful for analyzing suspicious attachments or artifacts in CI/build pipelines that process user-uploaded documents.
- SOC/IR — Learn: Useful forensic technique for IR scenarios involving OneNote-based phishing lures with embedded payloads; bookmark the method for future triage of .one file artifacts.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.