Chapter 229

OneNote .one File Weaponization

Microsoft OneNote's .one notebook format can embed arbitrary file attachments directly into a page as OLE objects. When displayed, embedded files appear as icons or images anywhere on the page. When a user double-clicks one, OneNote extracts and executes it. This created a major phishing wave in late 2022 and early 2023 after macro blocking killed .docm delivery — attackers discovered that OneNote would execute .hta, .bat, .vbs, .ps1, and .exe files embedded in a page, bypassing both email gateway inspection and MOTW restrictions under certain conditions. This chapter explains the .one file format, shows how to embed malicious attachments, builds a complete weaponized notebook, and maps the detection footprint.

The .one File Format

.one file format structure

  OneNote .one file is a proprietary binary format (MS-ONESTORE specification):
  ─────────────────────────────────────────────────────────────────────────
  Not ZIP-based (unlike .docx/.xlsx) — it's a single binary stream
  with a revision-based storage structure similar to a transaction log.

  Key object types relevant to weaponization:
  ┌────────────────────────────────────────────────────────────────────┐
  │ FileNodeList (the page content tree)                              │
  │   PageNode                                                        │
  │     ContentNode (text, images, tables)                           │
  │     EmbeddedFileNode  ←─── THE KEY OBJECT                        │
  │       FileName:    "invoice_viewer.hta"                          │
  │       FileData:    [binary content of the embedded file]          │
  │       Extension:   ".hta"                                        │
  │       CachedTitle: "Open Invoice"                                │
  └────────────────────────────────────────────────────────────────────┘

  Embedded files in OneNote:
  ─────────────────────────────────────────────────────────────────────
  • Stored as binary blobs inside the .one file (no separate ZIP entry)
  • Can be ANY file type: .hta, .bat, .vbs, .ps1, .exe, .dll, .lnk
  • Displayed as a clickable icon on the page
  • When double-clicked: OneNote extracts to a temp directory and opens
  • Temp path: %LOCALAPPDATA%\Packages\Microsoft.Office.OneNote_*/TempNotes\
    (modern OneNote) or %TEMP%\ (legacy OneNote)

  MOTW behavior:
  ─────────────────────────────────────────────────────────────────────
  Original issue (2022): OneNote did NOT apply MOTW to extracted embedded files.
  An .hta extracted from a OneNote file opened without SmartScreen warnings.
  Microsoft patched this in March 2023 — embedded files now show a warning:
  "This attachment could harm your computer and data. Do you want to open it?"
  
  The warning is a yes/no dialog — NOT a block. Social engineering still works:
  "Click Yes to view the secure invoice document" → victim clicks yes → .hta runs.

Creating a Weaponized OneNote File

Method 1: OneNote Application (Manual)

Steps to create a weaponized .one file in the OneNote desktop app:

1. Open OneNote for Windows (desktop app, not the UWP Store version)
2. Create a new notebook or open a section
3. Add lure text on the page:
   "INVOICE — Q1 2024
    Click the icon below to open the secure attachment:"
4. Insert → File Attachment:
   - Select your payload (e.g., payload.hta)
   - The file appears as a clickable icon on the page
5. You can change what the icon looks like by right-clicking → View As → Icon
6. Place the icon where it looks like a natural UI element (button, image, etc.)
7. Save → Export → One Page (.one format)
8. The .one file now contains your embedded payload

Overlay trick (common in 2022-2023 campaigns):
  Insert a large image (screenshot of a fake "Click here to open" button)
  Place the image EXACTLY over the embedded file icon
  → Victim clicks the "image" thinking it's a UI button
  → Actually clicking the embedded file icon underneath
  → OneNote extracts and opens the payload

Method 2: Python (onenote-builder)

"""
Create a weaponized OneNote .one file programmatically.
Uses the onepy or onenote-builder library.

pip install onepy   (limited functionality)

Alternatively: use the binary-level approach below.
"""

# The most practical programmatic approach: start from a valid .one template
# created in OneNote, then patch/inject the embedded file at the binary level.
# The MS-ONESTORE format is complex; binary patching is more reliable.

import struct, shutil, os

def embed_file_in_one(template_path: str, payload_path: str, output_path: str,
                       display_name: str = "invoice_viewer.hta"):
    """
    Simplified approach: copy a template .one that already has an embedded
    placeholder file, then patch the embedded file data with your payload.
    
    More reliable than building from scratch: OneNote format is complex.
    
    Workflow:
    1. In OneNote, create the page layout you want (lure text, image overlay)
    2. Embed a benign placeholder.hta (same extension as your payload)
    3. Save as template.one
    4. Use this function to patch the placeholder data with your real payload
    """
    shutil.copy(template_path, output_path)
    
    with open(template_path, 'rb') as f:
        data = bytearray(f.read())
    
    with open(payload_path, 'rb') as f:
        payload_bytes = f.read()
    
    # The placeholder file was saved in the template.
    # Find the placeholder data by looking for its known content.
    # (In practice: use a distinctive placeholder like a known header byte sequence)
    # This is a simplified illustration; real implementation parses JCID records.
    
    # For now: the practical advice is to use OneNote itself for creation
    # and a tool like scnr or EvilNote for injection.
    print(f"Template-based injection for {output_path}")
    print(f"Payload size: {len(payload_bytes)} bytes")
    print("Use EvilNote or manual OneNote for production weaponization")

Method 3: EvilNote (Recommended Tool)

# EvilNote: https://github.com/tothi/malicious-onenote
# Specifically designed for weaponizing .one files

git clone https://github.com/tothi/malicious-onenote
cd malicious-onenote

# Create a OneNote file with embedded payload.hta:
python3 malicious-onenote.py \
    -t "Click to view your Q1 2024 invoice" \
    -f payload.hta \
    -o Invoice_Q1_2024.one

# With a decoy image overlay:
python3 malicious-onenote.py \
    -t "CONFIDENTIAL INVOICE" \
    -f payload.hta \
    -i overlay_image.png \
    -o Invoice_Q1_2024.one

# The resulting .one file:
# - Shows the lure text on the page
# - Shows the overlay image (appearing to be a button)
# - The clickable file attachment is hidden under the image
# - Clicking "the image" actually triggers the .hta extraction and execution

Payload Choice for OneNote Embedding

Embedded payload type comparison

  Payload type │ Execution method             │ AMSI coverage │ Detection risk │ Notes
  ─────────────┼──────────────────────────────┼───────────────┼────────────────┼──────────────────
  .hta         │ mshta.exe runs it            │ VBScript AMSI │ MEDIUM         │ Best choice: full COM
  .bat / .cmd  │ cmd.exe runs it              │ None          │ MEDIUM         │ Limited to batch cmds
  .vbs         │ wscript.exe runs it          │ AMSI          │ MEDIUM         │ Full COM access
  .ps1         │ powershell.exe runs it       │ AMSI + SBL    │ HIGH           │ CLM may restrict
  .exe         │ Direct execution             │ Defender scan │ HIGH           │ Needs to bypass AV
  .lnk         │ Explorer handles it          │ None on .lnk  │ LOW-MEDIUM     │ LOLBin via target
  ─────────────┴──────────────────────────────┴───────────────┴────────────────┴──────────────────

  Best practice: embed a .hta that contains the AMSI bypass + downloader
  (see Chapter 20 for the full .hta payload template).
  The .hta runs via mshta.exe with no child-process warning and full COM access.

Detection Footprint

OneNote weaponization detection events

  Event                                    │ Sysmon ID │ When triggered
  ─────────────────────────────────────────┼───────────┼──────────────────────────────────
  ONENOTE.EXE process created              │ 1 (proc)  │ Victim opens the .one file
  Embedded file extracted to %TEMP%        │ 11 (file) │ OneNote extracts payload on click
  ONENOTE.EXE → mshta.exe                 │ 1 (proc)  │ .hta payload executed
  ONENOTE.EXE → cmd.exe                   │ 1 (proc)  │ .bat payload executed
  ONENOTE.EXE → wscript.exe               │ 1 (proc)  │ .vbs payload executed
  mshta.exe → outbound network            │ 3 (net)   │ HTA downloads stage 1
  DNS query for C2                         │ 22 (DNS)  │ Same download

  Key detection rule:
  ──────────────────────────────────────────────────────────────────────────────────
  ONENOTE.EXE (or onenoteim.exe) spawning:
    - mshta.exe, wscript.exe, cscript.exe, powershell.exe, cmd.exe
  These parent-child relationships are high-signal indicators.
  Legitimate OneNote rarely spawns these child processes.

  Microsoft's March 2023 patch behavior:
  OneNote now shows a warning dialog before opening ANY embedded attachment.
  This generates a user-visible security dialog before execution —
  the victim must explicitly click "Yes" to proceed.
  The dialog is NOT a block; it's a bump in the social engineering path.

Questions & Answers

Why did OneNote attacks spike specifically in Q4 2022 and Q1 2023?

Microsoft's July 2022 announcement about blocking VBA macros in downloaded Office documents closed the primary phishing delivery mechanism that most commodity malware families had used for years. Within weeks, researchers and threat actors began exploring alternatives. OneNote emerged as an attractive option because: (1) .one files weren't on email security teams' radar; (2) the embedded file extraction didn't apply MOTW to the extracted file; (3) OneNote is installed on most corporate Windows machines as part of Microsoft 365; (4) the "click here to view" social engineering setup is natural in a notebook format. The exploitation wave was swift — by November 2022, campaigns distributing Emotet, Qakbot, and various RATs via OneNote were well-documented. Microsoft responded with the March 2023 warning dialog patch.

Does the overlay trick still work after Microsoft's warning dialog patch?

The overlay trick (large image placed over the embedded file icon) still works in the sense that the victim clicks what looks like an image button — they may not realize they're activating an embedded file. After the March 2023 patch, clicking the embedded file shows a warning dialog before the payload executes. The social engineering message in the warning dialog matters: if the page says "Click Yes to view your secure invoice," many victims will click Yes. The technical bypass is gone (the file extraction always shows the warning now), but the social engineering bypass remains viable. The overall effectiveness of OneNote delivery dropped after the patch but didn't go to zero — it became a social engineering challenge rather than a pure technical one.

Can you embed more than one file in a OneNote page?

Yes — a OneNote page can have unlimited embedded file attachments. Multi-file techniques: (1) embed a legitimate decoy (a real PDF or Word doc) and the malicious payload side by side — victim clicks the decoy, sees a real document, assumes everything is normal; (2) embed the malicious file alongside a "Click here to view" image that the victim clicks instead; (3) for the DLL side-load pattern, embed both a signed EXE and a malicious DLL in the notebook — the .bat/.hta first drops both to disk, then runs the signed EXE. The multi-file embedding allows constructing the same two-file DLL side-load chain directly from OneNote without needing an ISO container.