20 lines
678 B
Text
20 lines
678 B
Text
|
rule Contains_UserForm_Object_1
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
author = "Martin Willing (https://evild3ad.com)"
|
||
|
|
description = "Detect UserForm object in MS Office document. Attackers use UserForm objects to obfuscate their scripts and malicious code."
|
||
|
|
alert = "May used to store a URL as a property of a userform"
|
||
|
|
reference = "https://isc.sans.edu/forums/diary/Tip+Quick+Analysis+of+Office+Maldoc/20751/"
|
||
|
|
reference = "http://blog.didierstevens.com/2016/03/11/update-oledump-py-version-0-0-23/"
|
||
|
|
hash = "4e0c55054c4f7c32aece5cfbbea02846"
|
||
|
|
date = "2016-03-11"
|
||
|
|
filetype = "Office documents"
|
||
|
|
|
||
|
|
strings:
|
||
|
|
|
||
|
|
$a = "Microsoft Forms 2.0" // Forms
|
||
|
|
$b = "http"
|
||
|
|
|
||
|
|
condition:
|
||
|
|
all of them
|
||
|
|
}
|