Snort mailing list archives
Offer a new sig for detecting possible Malicious RTF file
From: rmkml <rmkml () ligfy org>
Date: Wed, 13 Apr 2016 22:29:03 +0200 (CEST)
Hi, First, Thx @Sekoya_fr for sharing The http://etplc.org open source project offer a new sig for detecting possible Malicious RTF file opened by MS-Office: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT RTF Possible malicious MS-Office attempt"; flow:from_server,established; file_data; content:"{\\rtvpn"; within:7; distance:0; reference:cve,2015-1641; reference:url,www.sekoia.fr/blog/ms-office-exploit-analysis-cve-2015-1641/; reference:url,www.decalage.info/rtf_tricks; classtype:misc-activity; sid:1; rev:1;) See reference for more information. Don't forget check variables. Please send any comments. Regards @Rmkml ------------------------------------------------------------------------------ Find and fix application performance issues faster with Applications Manager Applications Manager provides deep performance insights into multiple tiers of your business applications. It resolves application problems quickly and reduces your MTTR. Get your free trial! https://ad.doubleclick.net/ddm/clk/302982198;130105516;z _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Offer a new sig for detecting possible Malicious RTF file rmkml (Apr 13)
- Re: Offer a new sig for detecting possible Malicious RTF file Matthew Mickel (Apr 21)