Skip to content

Instantly share code, notes, and snippets.

@Samirbous

Samirbous/gist:2e9a84f56bd6e7ee2da2da2e743f65cf

Created July 30, 2022 19:41
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Samirbous/2e9a84f56bd6e7ee2da2da2e743f65cf to your computer and use it in GitHub Desktop.
Save Samirbous/2e9a84f56bd6e7ee2da2da2e743f65cf to your computer and use it in GitHub Desktop.
Download ZIP
Raw
gistfile1.txt
sequence with maxspan=1m
[file where event.action != "deletion" and
file.extension : "doc*" and
/* xml or mht file header renamed as doc smuggling maldoc */
file.Ext.header_bytes : ("3c3f786d6c2076657273696f6e*", "4d494d452d56657273696f6e3a*") and
process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE")] by process.entity_id
[process where event.action == "start" and
process.parent.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE")] by process.parent.entity_id
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment