Skip to content

Instantly share code, notes, and snippets.

@Samirbous

Samirbous/dir traversal office

Created May 31, 2022 15:05
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Samirbous/9384ee6667f8b472ee6d9dcd505bd175 to your computer and use it in GitHub Desktop.
Save Samirbous/9384ee6667f8b472ee6d9dcd505bd175 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
dir traversal office
process where event.type in ("start", "process_started") and
process.parent.name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe") and
/* u can add other dir traversal patterns here */
process.command_line : ("*../../../..*", "*..\\..\\..\\..*", "*..//..//..//..*") and
process.executable : ("?:\\windows\\system32\\*.exe", "?:\\Windows\\SysWOW64\\*.exe")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment