Offer a new sig for detecting possible Malicious RTF file

[rmkml <rmkml () ligfy org>]

Hi,

First, Thx @Sekoya_fr for sharing

The http://etplc.org open source project offer a new sig for detecting possible Malicious RTF file opened by MS-Office:

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT RTF Possible malicious MS-Office attempt"; 
flow:from_server,established; 
file_data; content:"{\\rtvpn"; within:7; distance:0; reference:cve,2015-1641;
reference:url,www.sekoia.fr/blog/ms-office-exploit-analysis-cve-2015-1641/; 
reference:url,www.decalage.info/rtf_tricks; classtype:misc-activity; 
sid:1; rev:1;)

See reference for more information.

Don't forget check variables.

Please send any comments.

Regards
@Rmkml

------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!