SANS ISC: Extracting Embedded Files from OneNote (.one) Files

Sun, 01 Nov 2026 17:05:59 +0000

Engineer — Learn: OneNote has been abused as a malware delivery vector; knowing how to extract embedded objects from .one files is useful for analyzing suspicious attachments or artifacts in CI/build pipelines that process user-uploaded documents.
SOC/IR — Learn: Useful forensic technique for IR scenarios involving OneNote-based phishing lures with embedded payloads; bookmark the method for future triage of .one file artifacts.
Leader — Skip

Onenote on CuraSec