mirror of
https://github.com/valitydev/signature-base.git
synced 2024-11-06 10:05:18 +00:00
14 lines
400 B
Plaintext
14 lines
400 B
Plaintext
|
|
rule SUSP_CMD_Var_Expansion {
|
|
meta:
|
|
description = "Detects Office droppers that include a variable expansion string"
|
|
author = "Florian Roth"
|
|
reference = "https://twitter.com/asfakian/status/1044859525675843585"
|
|
date = "2018-09-26"
|
|
score = 60
|
|
strings:
|
|
$a1 = " /V:ON" ascii wide fullword
|
|
condition:
|
|
uint16(0) == 0xcfd0 and filesize < 500KB and $a1
|
|
}
|