YARA · ditekSHen detection

DITEKSHEN_INDICATOR_RTF_Exploit_Scripting

detects CVE-2017-8759 or CVE-2017-8570 weaponized RTF documents.

Suspicious / huntingditekSHen detectionBSD 2-Clause LicenseCompiles with YARA-X

Author: ditekSHen
Date: 2020-11-06
Modified: 2024-09-06
Score / Quality: 75 / 75

What this rule detects

detects CVE-2017-8759 or CVE-2017-8570 weaponized RTF documents.

It defines 20 patterns (15 text, 5 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

indicator-rtf-exploit-scripting.yarBSD 2-Clause License

rule DITEKSHEN_INDICATOR_RTF_Exploit_Scripting : CVE_2017_8759 CVE_2017_8570 FILE
{
	meta:
		description = "detects CVE-2017-8759 or CVE-2017-8570 weaponized RTF documents."
		author = "ditekSHen"
		id = "e8fd1231-3ef5-5b0b-987c-f55337804da3"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L270-L302"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a1f4c833f0132dcbe2b3677d6ac0f3597c152702515375d60d4332c21183bd76"
		score = 75
		quality = 75
		tags = "CVE-2017-8759, CVE-2017-8570, FILE"

	strings:
		$clsid1 = { 00 03 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 }
		$clsid2 = "0003000000000000c000000000000046" ascii nocase
		$clsid3 = "4f4c45324c696e6b" ascii nocase
		$clsid4 = "OLE2Link" ascii nocase
		$ole1 = { d0 cf 11 e0 a1 b1 1a e1 }
		$ole2 = "d0cf11e0a1b11ae1" ascii nocase
		$ole3 = "64306366313165306131623131616531" ascii
		$ole4 = "640a300a630a660a310a310a650a300a610a310a620a310a310a610a650a31"
		$ole5 = { 64 30 63 66 [0-2] 31 31 65 30 61 31 62 31 31 61 65 31 }
		$ole6 = "D0cf11E" ascii nocase
		$obj1 = "\\objhtml" ascii
		$obj2 = "\\objdata" ascii
		$obj3 = "\\objupdate" ascii
		$obj4 = "\\objemb" ascii
		$obj5 = "\\objautlink" ascii
		$obj6 = "\\objlink" ascii
		$obj7 = "\\mmath" ascii
		$obj8 = "\\objclass htmlfile" ascii
		$sct1 = { 33 (43|63) (3533|3733) (3433|3633) (3532|3732) (3439|3639)( 3530|3730) (3534|3734) (3443|3643) (3435|3635) (3534|3734) }
		$sct2 = { (3737|3537) (3733|3533) (3633|3433) (3732|3532) (3639|3439) (3730|3530) (3734|3534) (3245|3265) (3733|3533) (3638|3438) (3635|3435) (3643|3443) (3643|3443) }

	condition:
		uint32( 0 ) == 0x74725c7b and 1 of ( $clsid* ) and 1 of ( $ole* ) and 1 of ( $obj* ) and 1 of ( $sct* )
}

Strings (20 patterns)

Identifier	Type	Value	Modifiers
$clsid1	hex	{ 00 03 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 }
$clsid2	text	"0003000000000000c000000000000046"	ascii nocase
$clsid3	text	"4f4c45324c696e6b"	ascii nocase
$clsid4	text	"OLE2Link"	ascii nocase
$ole1	hex	{ d0 cf 11 e0 a1 b1 1a e1 }
$ole2	text	"d0cf11e0a1b11ae1"	ascii nocase
$ole3	text	"64306366313165306131623131616531"	ascii
$ole4	text	"640a300a630a660a310a310a650a300a610a310a620a310a310a610a650a31"
$ole5	hex	{ 64 30 63 66 [0-2] 31 31 65 30 61 31 62 31 31 61 65 31 }
$ole6	text	"D0cf11E"	ascii nocase
$obj1	text	"\\objhtml"	ascii
$obj2	text	"\\objdata"	ascii
$obj3	text	"\\objupdate"	ascii
$obj4	text	"\\objemb"	ascii
$obj5	text	"\\objautlink"	ascii
$obj6	text	"\\objlink"	ascii
$obj7	text	"\\mmath"	ascii
$obj8	text	"\\objclass htmlfile"	ascii
$sct1	hex	{ 33 (43\|63) (3533\|3733) (3433\|3633) (3532\|3732) (3439\|3639)( 3530\|3730) (3534\|3734) (3443\|3643) (3435\|3635) (3534\|3734) }
$sct2	hex	{ (3737\|3537) (3733\|3533) (3633\|3433) (3732\|3532) (3639\|3439) (3730\|3530) (3734\|3534) (3245\|3265) (3733\|3533) (3638\|3438) (3635\|3435) (3643\|3443) (3643\|3443) }

Condition

uint32( 0 ) == 0x74725c7b and 1 of ( $clsid* ) and 1 of ( $ole* ) and 1 of ( $obj* ) and 1 of ( $sct* )

In plain words (Heuristic)

The file must start with “{\rt” — an RTF document.
At least 1 patterns in ( $clsid* ) must match.
At least 1 patterns in ( $ole* ) must match.
At least 1 patterns in ( $obj* ) must match.
At least 1 patterns in ( $sct* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/ditekshen/detection

Licence & attribution

Author: ditekSHen

Source repository: ditekSHen detection @ e76c93dcde

Licence: BSD 2-Clause License (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: e8fd1231-3ef5-5b0b-987c-f55337804da3

Tags:CVE_2017_8759 CVE_2017_8570 FILE

DITEKSHEN_INDICATOR_RTF_EXPLOIT_CVE_2017_8759_1
Suspicious / huntingditekSHen detection· ditekSHen· 2020-11-06
DITEKSHEN_INDICATOR_OSX_RMM_Dwagent
Suspicious / huntingditekSHen detection· ditekSHen· 2023-08-22
DITEKSHEN_INDICATOR_KB_Gobuildid_Banload
Suspicious / huntingditekSHen detection· ditekSHen· 2021-01-21
DITEKSHEN_INDICATOR_KB_Gobuildid_Biopassdropper
Suspicious / huntingditekSHen detection· ditekSHen· 2021-01-21
DITEKSHEN_INDICATOR_KB_Gobuildid_Goldenaxe
Suspicious / huntingditekSHen detection· ditekSHen· 2021-01-21
DITEKSHEN_INDICATOR_KB_Gobuildid_Hive
Suspicious / huntingditekSHen detection· ditekSHen· 2021-01-21
DITEKSHEN_INDICATOR_KB_Gobuildid_Nemty
Suspicious / huntingditekSHen detection· ditekSHen· 2021-01-21
DITEKSHEN_INDICATOR_KB_Gobuildid_Nodachi
Suspicious / huntingditekSHen detection· ditekSHen· 2021-01-21