yara rule for OSX finder RCE

osx_finder_rce_21.yar

rule osx_finder_rce_21 {
    meta:
        description = "https://ssd-disclosure.com/ssd-advisory-macos-finder-rce/"

    strings:
        $xml_1 = /\<\?xml/
        $xml_2 = /\<plist/
        $xml_3 = /\<key\>URL/
        $sploit_str = /\<string\>(file|ssh|sftp|ftp|git|svn|news|afp|telnet)\:\/\// nocase

    condition:
        all of them
}