{"action":"created","issue":{"url":"https://api.github.com/repos/trustedsec/unicorn/issues/20","repository_url":"https://api.github.com/repos/trustedsec/unicorn","labels_url":"https://api.github.com/repos/trustedsec/unicorn/issues/20/labels{/name}","comments_url":"https://api.github.com/repos/trustedsec/unicorn/issues/20/comments","events_url":"https://api.github.com/repos/trustedsec/unicorn/issues/20/events","html_url":"https://github.com/trustedsec/unicorn/issues/20","id":162820825,"number":20,"title":"Macro detected by windows defender.","user":{"login":"Viss","id":1756255,"avatar_url":"https://avatars.githubusercontent.com/u/1756255?v=3","gravatar_id":"","url":"https://api.github.com/users/Viss","html_url":"https://github.com/Viss","followers_url":"https://api.github.com/users/Viss/followers","following_url":"https://api.github.com/users/Viss/following{/other_user}","gists_url":"https://api.github.com/users/Viss/gists{/gist_id}","starred_url":"https://api.github.com/users/Viss/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Viss/subscriptions","organizations_url":"https://api.github.com/users/Viss/orgs","repos_url":"https://api.github.com/users/Viss/repos","events_url":"https://api.github.com/users/Viss/events{/privacy}","received_events_url":"https://api.github.com/users/Viss/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-06-29T01:11:21Z","updated_at":"2016-06-30T09:19:22Z","closed_at":null,"body":"Looks like the format of the macro is being picked up by windows defender.\r\nIt may be a good idea to poach the output format of empire's macro payload, since that still doesn't get detected :D"},"comment":{"url":"https://api.github.com/repos/trustedsec/unicorn/issues/comments/229606963","html_url":"https://github.com/trustedsec/unicorn/issues/20#issuecomment-229606963","issue_url":"https://api.github.com/repos/trustedsec/unicorn/issues/20","id":229606963,"user":{"login":"beethical","id":19576824,"avatar_url":"https://avatars.githubusercontent.com/u/19576824?v=3","gravatar_id":"","url":"https://api.github.com/users/beethical","html_url":"https://github.com/beethical","followers_url":"https://api.github.com/users/beethical/followers","following_url":"https://api.github.com/users/beethical/following{/other_user}","gists_url":"https://api.github.com/users/beethical/gists{/gist_id}","starred_url":"https://api.github.com/users/beethical/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/beethical/subscriptions","organizations_url":"https://api.github.com/users/beethical/orgs","repos_url":"https://api.github.com/users/beethical/repos","events_url":"https://api.github.com/users/beethical/events{/privacy}","received_events_url":"https://api.github.com/users/beethical/received_events","type":"User","site_admin":false},"created_at":"2016-06-30T09:19:22Z","updated_at":"2016-06-30T09:19:22Z","body":"Same problem here!\r\nToday, I checked the latest Macro created via unicorn (and veil) through every available Antivirus, and some of them detected the Macro as a Trojan,even before opening the document ! :)\r\nThe screenshot below shows the results:\r\n\r\n![photo_2016-06-30_13-43-17](https://cloud.githubusercontent.com/assets/19576824/16483354/476f719c-3ec9-11e6-80ef-c6c4bb1bd70a.jpg)\r\n"}}
{"actor":{"display_login":"beethical"}}