Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
sequence with maxspan=1m
[file where event.action != "deletion" and
file.extension : "doc*" and
/* xml or mht file header renamed as doc smuggling maldoc */
file.Ext.header_bytes : ("3c3f786d6c2076657273696f6e*", "4d494d452d56657273696f6e3a*") and : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE")] by process.entity_id
[process where event.action == "start" and : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE")] by process.parent.entity_id
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment