DITEKSHEN_INDICATOR_OOXML_Excel4Macros_Autoopenhidden

rule DITEKSHEN_INDICATOR_OOXML_Excel4Macros_Autoopenhidden : FILE
{
	meta:
		description = "Detects OOXML (decompressed) documents with Excel 4 Macros XLM macrosheet auto_open and state hidden"
		author = "ditekSHen"
		id = "c5aab620-5254-5fc6-b236-4fe0f69cbd8e"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L900-L910"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a93d8aa7ac025a0c2e8a9ac833f6d4c3cd3769ffca3f87455f43411d0021e828"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "INDICATOR.OOXML.Excel4MacrosEXEC"

	strings:
		$s1 = "state=\"veryhidden\"" ascii nocase
		$s2 = "<definedName name=\"_xlnm.Auto_Open" ascii nocase

	condition:
		uint32( 0 ) == 0x6d783f3c and all of them
}