YARA rule for detecting "path segment" variant of CVE-2024-38217 LNK stomping exploits

pathsegment.yara

rule PathSegmentLNK {
strings:
        $lnk_header = { 4C 00 00 00 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
        $exe_string = ".exe" nocase
        $c_drive = "c:\\" nocase
    condition:
        $lnk_header at 0 and
        for any i in (0x80..0xC0): (
            uint8(i) == 0x5C and
            for any j in (i+1..0xC0): (uint8(j) == 0x5C)
        ) and
        $exe_string in (0x80..0xC0) and
        $c_drive in (0x40..0x80)
}