Yara rule to detect word documents with equations (CVE-2017-11882 / CVE-2018-0802)

doc_equations.yar

rule doc_equations {

    meta:
        author = "Javier Rascon Mesa"
        description = "Detects documents that contains equations"

    strings:
        $hdr_0 = {d0 cf 11 e0}
        $hdr_1 = "{\\rt" ascii

        $txt = "02ce020000000000c000000000000046"
        $hex = {02 ce 02 00 00 00 00 00 c0 00 00 00 00 00 00 46}

    condition:
        for any of ($hdr_*): ($ at 0) and ($txt or $hex)

}