From 89cd779db0882ff782390116112881b09dccc34c Mon Sep 17 00:00:00 2001
From: John Lambert <johnla@microsoft.com>
Date: Wed, 1 Apr 2020 12:49:19 -0700
Subject: [PATCH] Update gen_Excel4Macro_Sharpshooter.yar

There are some misses due to file size restriction. These maldoc files are over 2MB:

d75f78cf9fcb4e643478858d7136009f5b5ec8eb36df0e7ffa6604700b04c904
be6dc7cc4c8d1bc2375020d2f8e3f5f532c7c400a1714961a43749b00caf6569
---
 yara/gen_Excel4Macro_Sharpshooter.yar | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/yara/gen_Excel4Macro_Sharpshooter.yar b/yara/gen_Excel4Macro_Sharpshooter.yar
index 547fc01..9f1ae09 100644
--- a/yara/gen_Excel4Macro_Sharpshooter.yar
+++ b/yara/gen_Excel4Macro_Sharpshooter.yar
@@ -60,7 +60,7 @@ rule SUSP_Excel4Macro_AutoOpen
 
 
     condition:
-        filesize < 400KB
+        filesize < 3000KB
         and $header_docf at 0
         and $s1
         and any of ($Auto_*)