16 lines
542 B
Text
16 lines
542 B
Text
rule RTF_Shellcode
|
||
{
|
||
meta:
|
||
author = "RSA-IR – Jared Greenhill"
|
||
date = "01/21/13"
|
||
description = "identifies RTF's with potential shellcode"
|
||
reference = "https://community.rsa.com/community/products/netwitness/blog/2014/02/12/triaging-malicious-microsoft-office-documents-cve-2012-0158"
|
||
filetype = "RTF"
|
||
|
||
strings:
|
||
$rtfmagic={7B 5C 72 74 66}
|
||
$scregex=/[39 30]{2,20}/
|
||
|
||
condition:
|
||
($rtfmagic at 0) and ($scregex)
|
||
}
|