deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: WEBSHELL_PAS_webshell_PerlNetworkScript
Repository: Neo23x0/signature-base
Detects: Detects PERL scripts created by P.A.S. webshell
Author: FR/ANSSI/SDO
Reference: https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf

Pattern signatures:
$pl_start = "#!/usr/bin/perl\n$SIG{'CHLD'}='IGNORE'; use IO::Socket; use FileHandle;"
      $pl_status = "$o=\" [OK]\";$e=\" Error: \""
      $pl_socket = "socket(SOCKET, PF_INET, SOCK_STREAM,$tcp) or die print \"$l$e$!$l"
      $msg1 = "print \"$l OK! I\\'m successful connected.$l\""
      $msg2 = "print \"$l OK! I\\'m accept connection.$l\""

Detection condition:
filesize < 6000 and
      ( $pl_start at 0 and all of ($pl*) ) or
      any of ($msg*)

Full rule:
rule WEBSHELL_PAS_webshell_PerlNetworkScript {
   meta:
      author = "FR/ANSSI/SDO"
      description = "Detects PERL scripts created by P.A.S. webshell"
      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
      date = "2021-02-15"
      score = 90
      id = "1625b63f-ead7-5712-92b4-0ce6ecc49fd4"
   strings:
      $pl_start = "#!/usr/bin/perl\n$SIG{'CHLD'}='IGNORE'; use IO::Socket; use FileHandle;"
      $pl_status = "$o=\" [OK]\";$e=\" Error: \""
      $pl_socket = "socket(SOCKET, PF_INET, SOCK_STREAM,$tcp) or die print \"$l$e$!$l"
      $msg1 = "print \"$l OK! I\\'m successful connected.$l\""
      $msg2 = "print \"$l OK! I\\'m accept connection.$l\""
   condition:
      filesize < 6000 and
      ( $pl_start at 0 and all of ($pl*) ) or
      any of ($msg*)
}
YARA Detection Rule: WEBSHELL_PAS_webshell_SQLDumpFile
Repository: Neo23x0/signature-base
Detects: Detects SQL dump file created by P.A.S. webshell
Author: FR/ANSSI/SDO
Reference: https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf

Pattern signatures:
$ = "-- [ SQL Dump created by P.A.S. ] --"

Detection condition:
1 of them

Full rule:
rule WEBSHELL_PAS_webshell_SQLDumpFile {
   meta:
      author = "FR/ANSSI/SDO"
      description = "Detects SQL dump file created by P.A.S. webshell"
      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
      date = "2021-02-15"
      score = 90
      id = "4c26feeb-3031-5c91-9eeb-4b5fe9702e39"
   strings:
      $ = "-- [ SQL Dump created by P.A.S. ] --"
   condition:
      1 of them
}
YARA Detection Rule: APT_MAL_Sandworm_Exaramel_Configuration_Key
Repository: Neo23x0/signature-base
Detects: Detects the encryption key for the configuration file used by Exaramel malware as seen in sample e1ff72[...]
Author: FR/ANSSI/SDO
Reference: https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf

Pattern signatures:
$ = "odhyrfjcnfkdtslt"

Detection condition:
all of them

Full rule:
rule APT_MAL_Sandworm_Exaramel_Configuration_Key {
   meta:
      author = "FR/ANSSI/SDO"
      description = "Detects the encryption key for the configuration file used by Exaramel malware as seen in sample e1ff72[...]"
      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
      date = "2021-02-15"
      score = 80
      id = "8078de62-3dd2-5ee0-8bda-f508e4013144"
   strings:
      $ = "odhyrfjcnfkdtslt"
   condition:
      all of them
}
YARA Detection Rule: APT_MAL_Sandworm_Exaramel_Configuration_Name_Encrypted
Repository: Neo23x0/signature-base
Detects: Detects the specific name of the configuration file in Exaramel malware as seen in sample e1ff72[...]
Author: FR/ANSSI/SDO
Reference: https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf

Pattern signatures:
$ = "configtx.json"

Detection condition:
all of them

Full rule:
rule APT_MAL_Sandworm_Exaramel_Configuration_Name_Encrypted {
   meta:
      author = "FR/ANSSI/SDO"
      description = "Detects the specific name of the configuration file in Exaramel malware as seen in sample e1ff72[...]"
      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
      date = "2021-02-15"
      score = 80
      id = "1c06f5fc-3435-51cd-92fb-17a4ab6b63ad"
   strings:
      $ = "configtx.json"
   condition:
      all of them
}
YARA Detection Rule: APT_MAL_Sandworm_Exaramel_Configuration_File_Plaintext
Repository: Neo23x0/signature-base
Detects: Detects contents of the configuration file used by Exaramel (plaintext)
Author: FR/ANSSI/SDO
Reference: https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf

Pattern signatures:
$ = /\{"Hosts":\[".{10,512}"\],"Proxy":".{0,512}","Version":".{1,32}","Guid":"/

Detection condition:
all of them

Full rule:
rule APT_MAL_Sandworm_Exaramel_Configuration_File_Plaintext {
   meta:
      author = "FR/ANSSI/SDO"
      description = "Detects contents of the configuration file used by Exaramel (plaintext)"
      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
      date = "2021-02-15"
      score = 80
      id = "6f0d834b-e6c8-59e6-bf9a-b4fd9c0b2297"
   strings:
      $ = /\{"Hosts":\[".{10,512}"\],"Proxy":".{0,512}","Version":".{1,32}","Guid":"/
   condition:
      all of them
}
YARA Detection Rule: APT_MAL_Sandworm_Exaramel_Configuration_File_Ciphertext
Repository: Neo23x0/signature-base
Detects: Detects contents of the configuration file used by Exaramel (encrypted with key odhyrfjcnfkdtslt, sample e1ff72[...]
Author: FR/ANSSI/SDO
Reference: https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf

Pattern signatures:
$ = { 6F B6 08 E9 A3 0C 8D 5E DD BE D4 } // encrypted with key odhyrfjcnfkdtslt

Detection condition:
all of them

Full rule:
rule APT_MAL_Sandworm_Exaramel_Configuration_File_Ciphertext {
   meta:
      author = "FR/ANSSI/SDO"
      description = "Detects contents of the configuration file used by Exaramel (encrypted with key odhyrfjcnfkdtslt, sample e1ff72[...]"
      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
      date = "2021-02-15"
      score = 80
      id = "763dbb17-2bad-5b40-8a7b-b71bc5849cd9"
   strings:
      $ = { 6F B6 08 E9 A3 0C 8D 5E DD BE D4 } // encrypted with key odhyrfjcnfkdtslt
   condition:
      all of them
}
YARA Detection Rule: APT_MAL_Sandworm_Exaramel_Socket_Path
Repository: Neo23x0/signature-base
Detects: Detects path of the unix socket created to prevent concurrent executions in Exaramel malware
Author: FR/ANSSI/SDO
Reference: https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf

Pattern signatures:
$ = "/tmp/.applocktx"

Detection condition:
all of them

Full rule:
rule APT_MAL_Sandworm_Exaramel_Socket_Path {
   meta:
      author = "FR/ANSSI/SDO"
      description = "Detects path of the unix socket created to prevent concurrent executions in Exaramel malware"
      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
      date = "2021-02-15"
      score = 80
      id = "3aab84c9-9748-5d11-9cd7-efa9151036cf"
   strings:
      $ = "/tmp/.applocktx"
   condition:
      all of them
}
YARA Detection Rule: APT_MAL_Sandworm_Exaramel_Task_Names
Repository: Neo23x0/signature-base
Detects: Detects names of the tasks received from the CC server in Exaramel malware
Author: FR/ANSSI/SDO
Reference: https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf

Pattern signatures:
$ = "App.Delete"
      $ = "App.SetServer"
      $ = "App.SetProxy"
      $ = "App.SetTimeout"
      $ = "App.Update"
      $ = "IO.ReadFile"
      $ = "IO.WriteFile"
      $ = "OS.ShellExecute"

Detection condition:
all of them

Full rule:
rule APT_MAL_Sandworm_Exaramel_Task_Names {
   meta:
      author = "FR/ANSSI/SDO"
      description = "Detects names of the tasks received from the CC server in Exaramel malware"
      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
      date = "2021-02-15"
      score = 80
      id = "185f2f3b-bf5c-54af-bca2-400d08bf9c91"
   strings:
      $ = "App.Delete"
      $ = "App.SetServer"
      $ = "App.SetProxy"
      $ = "App.SetTimeout"
      $ = "App.Update"
      $ = "IO.ReadFile"
      $ = "IO.WriteFile"
      $ = "OS.ShellExecute"
   condition:
      all of them
}
YARA Detection Rule: APT_MAL_Sandworm_Exaramel_Struct
Repository: Neo23x0/signature-base
Detects: Detects the beginning of type _type struct for some of the most important structs in Exaramel malware
Author: FR/ANSSI/SDO
Reference: https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf

Pattern signatures:
$struct_le_config = {70 00 00 00 00 00 00 00 58 00 00 00 00 00 00 00 47 2d 28 42 0? [2] 19}
      $struct_le_worker = {30 00 00 00 00 00 00 00 30 00 00 00 00 00 00 00 46 6a 13 e2 0? [2] 19}
      $struct_le_client = {20 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 7b 6a 49 84 0? [2] 19}
      $struct_le_report = {30 00 00 00 00 00 00 00 28 00 00 00 00 00 00 00 bf 35 0d f9 0? [2] 19}
      $struct_le_task = {50 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 88 60 a1 c5 0? [2] 19}

Detection condition:
any of them

Full rule:
rule APT_MAL_Sandworm_Exaramel_Struct {
   meta:
      author = "FR/ANSSI/SDO"
      description = "Detects the beginning of type _type struct for some of the most important structs in Exaramel malware"
      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
      date = "2021-02-15"
      score = 80
      id = "8282e485-966c-554d-8e41-70dc1657f5ea"
   strings:
      $struct_le_config = {70 00 00 00 00 00 00 00 58 00 00 00 00 00 00 00 47 2d 28 42 0? [2] 19}
      $struct_le_worker = {30 00 00 00 00 00 00 00 30 00 00 00 00 00 00 00 46 6a 13 e2 0? [2] 19}
      $struct_le_client = {20 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 7b 6a 49 84 0? [2] 19}
      $struct_le_report = {30 00 00 00 00 00 00 00 28 00 00 00 00 00 00 00 bf 35 0d f9 0? [2] 19}
      $struct_le_task = {50 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 88 60 a1 c5 0? [2] 19}
   condition:
      any of them
}
YARA Detection Rule: APT_MAL_Sandworm_Exaramel_Strings_Typo
Repository: Neo23x0/signature-base
Detects: Detects misc strings in Exaramel malware with typos
Author: FR/ANSSI/SDO
Reference: https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf

Pattern signatures:
$typo1 = "/sbin/init | awk "
      $typo2 = "Syslog service for monitoring \n"
      $typo3 = "Error.Can't update app! Not enough update archive."
      $typo4 = ":\"metod\""

Detection condition:
3 of ($typo*)

Full rule:
rule APT_MAL_Sandworm_Exaramel_Strings_Typo {
   meta:
      author = "FR/ANSSI/SDO"
      description = "Detects misc strings in Exaramel malware with typos"
      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
      date = "2021-02-15"
      score = 80
      id = "fdc79b87-eb9e-5751-9474-ff653b073165"
   strings:
      $typo1 = "/sbin/init | awk "
      $typo2 = "Syslog service for monitoring \n"
      $typo3 = "Error.Can't update app! Not enough update archive."
      $typo4 = ":\"metod\""
   condition:
      3 of ($typo*)
}
YARA Detection Rule: APT_MAL_Sandworm_Exaramel_Strings
Repository: Neo23x0/signature-base
Detects: Detects Strings used by Exaramel malware
Author: FR/ANSSI/SDO (composed from 4 saparate rules by Florian Roth)
Reference: https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf

Pattern signatures:
$persistence1 = "systemd"
      $persistence2 = "upstart"
      $persistence3 = "systemV"
      $persistence4 = "freebsd rc"

      $report1 = "systemdupdate.rep"
      $report2 = "upstartupdate.rep"
      $report3 = "remove.rep"

      $url1 = "/tasks.get/"
      $url2 = "/time.get/"
      $url3 = "/time.set"
      $url4 = "/tasks.report"
      $url5 = "/attachment.get/"
      $url6 = "/auth/app"

Detection condition:
( 5 of ($url*) and all of ($persistence*) ) or 
      ( all of ($persistence*) and all of ($report*) ) or 
      ( 5 of ($url*) and all of ($report*) )

Full rule:
rule APT_MAL_Sandworm_Exaramel_Strings {
   meta:
      author = "FR/ANSSI/SDO (composed from 4 saparate rules by Florian Roth)"
      description = "Detects Strings used by Exaramel malware"
      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
      date = "2021-02-15"
      score = 80
      id = "fdc79b87-eb9e-5751-9474-ff653b073165"
   strings:
      $persistence1 = "systemd"
      $persistence2 = "upstart"
      $persistence3 = "systemV"
      $persistence4 = "freebsd rc"

      $report1 = "systemdupdate.rep"
      $report2 = "upstartupdate.rep"
      $report3 = "remove.rep"

      $url1 = "/tasks.get/"
      $url2 = "/time.get/"
      $url3 = "/time.set"
      $url4 = "/tasks.report"
      $url5 = "/attachment.get/"
      $url6 = "/auth/app"
   condition:
      ( 5 of ($url*) and all of ($persistence*) ) or 
      ( all of ($persistence*) and all of ($report*) ) or 
      ( 5 of ($url*) and all of ($report*) )
}
YARA Detection Rule: SUSP_PS1_Msdt_Execution_May22
Repository: Neo23x0/signature-base
Detects: Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation
Author: Nasreddine Bencherchali, Christian Burkard
Reference: https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e

Pattern signatures:
$a = "PCWDiagnostic" ascii wide fullword
      $sa1 = "msdt.exe" ascii wide
      $sa2 = "msdt " ascii wide
      $sa3 = "ms-msdt" ascii wide

      $sb1 = "/af " ascii wide
      $sb2 = "-af " ascii wide
      $sb3 = "IT_BrowseForFile=" ascii wide

      /* OriginalFilename pcwrun.exe */
      $fp1 = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00
               46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00
               00 00 70 00 63 00 77 00 72 00 75 00 6E 00 2E 00
               65 00 78 00 65 00 }
      $fp2 = "FilesFullTrust" wide
      $fp3 = "Cisco Spark" ascii wide
      $fp4 = "author: " ascii

Detection condition:
filesize < 10MB
      and $a
      and 1 of ($sa*)
      and 1 of ($sb*)
      and not 1 of ($fp*)
      // not JSON
      and not uint8(0) == 0x7B

Full rule:
rule SUSP_PS1_Msdt_Execution_May22 {
   meta:
      description = "Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation"
      author = "Nasreddine Bencherchali, Christian Burkard"
      date = "2022-05-31"
      modified = "2025-03-21"
      reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
      score = 65
   strings:
      $a = "PCWDiagnostic" ascii wide fullword
      $sa1 = "msdt.exe" ascii wide
      $sa2 = "msdt " ascii wide
      $sa3 = "ms-msdt" ascii wide

      $sb1 = "/af " ascii wide
      $sb2 = "-af " ascii wide
      $sb3 = "IT_BrowseForFile=" ascii wide

      /* OriginalFilename pcwrun.exe */
      $fp1 = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00
               46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00
               00 00 70 00 63 00 77 00 72 00 75 00 6E 00 2E 00
               65 00 78 00 65 00 }
      $fp2 = "FilesFullTrust" wide
      $fp3 = "Cisco Spark" ascii wide
      $fp4 = "author: " ascii
   condition:
      filesize < 10MB
      and $a
      and 1 of ($sa*)
      and 1 of ($sb*)
      and not 1 of ($fp*)
      // not JSON
      and not uint8(0) == 0x7B
}
YARA Detection Rule: SUSP_Doc_WordXMLRels_May22
Repository: Neo23x0/signature-base
Detects: Detects a suspicious pattern in docx document.xml.rels file as seen in CVE-2022-30190 / Follina exploitation
Author: Tobias Michalski, Christian Burkard, Wojciech Cieslak
Reference: https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e

Pattern signatures:
$a1 = "<Relationships" ascii
      $a2 = "TargetMode=\"External\"" ascii

      $x1 = ".html!" ascii
      $x2 = ".htm!" ascii
      $x3 = "%2E%68%74%6D%6C%21" ascii /* encoded version of .html! */
      $x4 = "%2E%68%74%6D%21" ascii /* encoded version of .htm! */

Detection condition:
filesize < 50KB
      and all of ($a*)
      and 1 of ($x*)

Full rule:
rule SUSP_Doc_WordXMLRels_May22 {
   meta:
      description = "Detects a suspicious pattern in docx document.xml.rels file as seen in CVE-2022-30190 / Follina exploitation"
      author = "Tobias Michalski, Christian Burkard, Wojciech Cieslak"
      date = "2022-05-30"
      modified = "2022-06-20"
      reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
      hash = "62f262d180a5a48f89be19369a8425bec596bc6a02ed[PII_REDACTED]0791ae3df0"
      score = 70
      id = "304c4816-b2f6-5319-9fe9-8f74bdb82ad0"
   strings:
      $a1 = "<Relationships" ascii
      $a2 = "TargetMode=\"External\"" ascii

      $x1 = ".html!" ascii
      $x2 = ".htm!" ascii
      $x3 = "%2E%68%74%6D%6C%21" ascii /* encoded version of .html! */
      $x4 = "%2E%68%74%6D%21" ascii /* encoded version of .htm! */
   condition:
      filesize < 50KB
      and all of ($a*)
      and 1 of ($x*)
}
YARA Detection Rule: SUSP_Doc_RTF_ExternalResource_May22
Repository: Neo23x0/signature-base
Detects: Detects a suspicious pattern in RTF files which downloads external resources as seen in CVE-2022-30190 / Follina exploitation
Author: Tobias Michalski, Christian Burkard
Reference: https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e

Pattern signatures:
$s1 = " LINK htmlfile \"http" ascii
      $s2 = ".html!\" " ascii

Detection condition:
uint32be(0) == 0x7B5C7274 and
      filesize < 300KB and
      all of them

Full rule:
rule SUSP_Doc_RTF_ExternalResource_May22 {
   meta:
      description = "Detects a suspicious pattern in RTF files which downloads external resources as seen in CVE-2022-30190 / Follina exploitation"
      author = "Tobias Michalski, Christian Burkard"
      date = "2022-05-30"
      modified = "2022-05-31"
      reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
      score = 70
      id = "71bb97e0-ec12-504c-a1f6-25039ac91c86"
   strings:
      $s1 = " LINK htmlfile \"http" ascii
      $s2 = ".html!\" " ascii
   condition:
      uint32be(0) == 0x7B5C7274 and
      filesize < 300KB and
      all of them
}
YARA Detection Rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22
Repository: Neo23x0/signature-base
Detects: Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation
Author: Tobias Michalski, Christian Burkard
Reference: https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e

Pattern signatures:
$re1 = /location\.href\s{0,20}=\s{0,20}"ms-msdt:/
      $a1 = "%6D%73%2D%6D%73%64%74%3A%2F" ascii /* URL encoded "ms-msdt:/" */

Detection condition:
filesize > 3KB and
      filesize < 100KB and
      1 of them

Full rule:
rule EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 {
   meta:
      description = "Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation"
      author = "Tobias Michalski, Christian Burkard"
      date = "2022-05-30"
      modified = "2022-07-18"
      reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
      hash1 = "4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784"
      hash2 = "778cbb0ee4afffca6a0b788a97bc2f4855ceb69ddc5eaa230acfa2834e1aeb07"
      score = 80
      id = "62e67c25-a420-5dac-9d1c-b0648ea6b574"
   strings:
      $re1 = /location\.href\s{0,20}=\s{0,20}"ms-msdt:/
      $a1 = "%6D%73%2D%6D%73%64%74%3A%2F" ascii /* URL encoded "ms-msdt:/" */
   condition:
      filesize > 3KB and
      filesize < 100KB and
      1 of them
}
YARA Detection Rule: SUSP_Doc_RTF_OLE2Link_Jun22
Repository: Neo23x0/signature-base
Detects: Detects a suspicious pattern in RTF files which downloads external resources
Author: Christian Burkard
Reference: Internal Research

Pattern signatures:
$sa = "\\objdata" ascii nocase

      $sb1 = "4f4c45324c696e6b" ascii /* OLE2Link */
      $sb2 = "4F4C45324C696E6B" ascii

      $sc1 = "d0cf11e0a1b11ae1" ascii /* docfile magic - doc file albilae */
      $sc2 = "D0CF11E0A1B11AE1" ascii

      $x1 = "[PII_REDACTED]0070003a002f002f00" ascii /* http:// */
      $x2 = "[PII_REDACTED]0070003A002F002F00" ascii
      $x3 = "[PII_REDACTED][PII_REDACTED]3a002f002f00" ascii /* https:// */
      $x4 = "[PII_REDACTED][PII_REDACTED]3A002F002F00" ascii
      $x5 = "[PII_REDACTED]003a002f002f00" ascii /* ftp:// */
      $x6 = "[PII_REDACTED]003A002F002F00" ascii
      /* TODO: more protocols */

Detection condition:
( uint32be(0) == 0x7B5C7274 or uint32be(0) == 0x7B5C2A5C ) /* RTF */
      and $sa
      and 1 of ($sb*)
      and 1 of ($sc*)
      and 1 of ($x*)

Full rule:
rule SUSP_Doc_RTF_OLE2Link_Jun22 {
   meta:
      description = "Detects a suspicious pattern in RTF files which downloads external resources"
      author = "Christian Burkard"
      date = "2022-06-01"
      reference = "Internal Research"
      hash = "4abc20e5130b59639e20bd6b8ad759af18eb284f46e99a5cc6b4f16f09456a68"
      score = 75
      id = "e9c83d58-6214-51d5-882a-4bd2ed6acc9a"
   strings:
      $sa = "\\objdata" ascii nocase

      $sb1 = "4f4c45324c696e6b" ascii /* OLE2Link */
      $sb2 = "4F4C45324C696E6B" ascii

      $sc1 = "d0cf11e0a1b11ae1" ascii /* docfile magic - doc file albilae */
      $sc2 = "D0CF11E0A1B11AE1" ascii

      $x1 = "[PII_REDACTED]0070003a002f002f00" ascii /* http:// */
      $x2 = "[PII_REDACTED]0070003A002F002F00" ascii
      $x3 = "[PII_REDACTED][PII_REDACTED]3a002f002f00" ascii /* https:// */
      $x4 = "[PII_REDACTED][PII_REDACTED]3A002F002F00" ascii
      $x5 = "[PII_REDACTED]003a002f002f00" ascii /* ftp:// */
      $x6 = "[PII_REDACTED]003A002F002F00" ascii
      /* TODO: more protocols */
   condition:
      ( uint32be(0) == 0x7B5C7274 or uint32be(0) == 0x7B5C2A5C ) /* RTF */
      and $sa
      and 1 of ($sb*)
      and 1 of ($sc*)
      and 1 of ($x*)
}
YARA Detection Rule: SUSP_DOC_RTF_ExternalResource_EMAIL_Jun22
Repository: Neo23x0/signature-base
Detects: Detects a suspicious pattern in RTF files which downloads external resources as seen in CVE-2022-30190 / Follina exploitation inside e-mail attachment
Author: Christian Burkard
Reference: https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e

Pattern signatures:
/* <Relationships */
      $sa1 ="PFJlbGF0aW9uc2hpcH" ascii
      $sa2 ="xSZWxhdGlvbnNoaXBz" ascii
      $sa3 ="8UmVsYXRpb25zaGlwc" ascii
      /* TargetMode="External" */
      $sb1 ="VGFyZ2V0TW9kZT0iRXh0ZXJuYWwi" ascii
      $sb2 ="RhcmdldE1vZGU9IkV4dGVybmFsI" ascii
      $sb3 ="UYXJnZXRNb2RlPSJFeHRlcm5hbC" ascii
      /* .html!" */
      $sc1 ="Lmh0bWwhI" ascii
      $sc2 ="5odG1sIS" ascii
      $sc3 ="uaHRtbCEi" ascii

Detection condition:
filesize < 400KB
      and 1 of ($sa*)
      and 1 of ($sb*)
      and 1 of ($sc*)

Full rule:
rule SUSP_DOC_RTF_ExternalResource_EMAIL_Jun22 {
   meta:
      description = "Detects a suspicious pattern in RTF files which downloads external resources as seen in CVE-2022-30190 / Follina exploitation inside e-mail attachment"
      author = "Christian Burkard"
      date = "2022-06-01"
      reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
      score = 70
      id = "3ddc838c-8520-5572-9652-8cb823f83e27"
   strings:
      /* <Relationships */
      $sa1 ="PFJlbGF0aW9uc2hpcH" ascii
      $sa2 ="xSZWxhdGlvbnNoaXBz" ascii
      $sa3 ="8UmVsYXRpb25zaGlwc" ascii
      /* TargetMode="External" */
      $sb1 ="VGFyZ2V0TW9kZT0iRXh0ZXJuYWwi" ascii
      $sb2 ="RhcmdldE1vZGU9IkV4dGVybmFsI" ascii
      $sb3 ="UYXJnZXRNb2RlPSJFeHRlcm5hbC" ascii
      /* .html!" */
      $sc1 ="Lmh0bWwhI" ascii
      $sc2 ="5odG1sIS" ascii
      $sc3 ="uaHRtbCEi" ascii
   condition:
      filesize < 400KB
      and 1 of ($sa*)
      and 1 of ($sb*)
      and 1 of ($sc*)
}