Skip to content

Instantly share code, notes, and snippets.

@halos
Created March 21, 2018 13:14
  • Star 2 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
Star You must be signed in to star a gist
Save halos/d69573e7183e518dc56169795b0ca070 to your computer and use it in GitHub Desktop.
Yara rule to detect word documents with equations (CVE-2017-11882 / CVE-2018-0802)
rule doc_equations {
meta:
author = "Javier Rascon Mesa"
description = "Detects documents that contains equations"
strings:
$hdr_0 = {d0 cf 11 e0}
$hdr_1 = "{\\rt" ascii
$txt = "02ce020000000000c000000000000046"
$hex = {02 ce 02 00 00 00 00 00 c0 00 00 00 00 00 00 46}
condition:
for any of ($hdr_*): ($ at 0) and ($txt or $hex)
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment