SEKOIA_Exploit_Win_Cloudatlas_Cve_2018_0798

rule SEKOIA_Exploit_Win_Cloudatlas_Cve_2018_0798 : CVE_2018_0798 FILE
{
	meta:
		description = "Detect RTF files used by CloudAtlas to exploit CVE-2018-0798"
		author = "Sekoia.io"
		id = "fcff4bc7-fe88-4546-bb5b-f2a1c2f8b0a5"
		date = "2022-11-15"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/exploit_win_cloudatlas_cve_2018_0798.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "c2064c7f4826c46bc609c472597366fd"
		hash = "e2281402c63d4b544b81678250d24e61"
		hash = "a97fa135d7e42886bcfdacca0d96c047"
		logic_hash = "1ed1009d77835f60834c20e61158b00ce7416ade8aa86c3314f4d8d1f6742fa0"
		score = 75
		quality = 80
		tags = "CVE-2018-0798, FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "6060606061616161616161616161616161616161" ascii nocase
		$ = "FB0B00004bE8FFFFFFFFC35F83C71B33C966B908" ascii nocase
		$ = "010f0d00ddd8d97424f4668137" ascii nocase

	condition:
		uint32be( 0 ) == 0x7b5c7274 and all of them
}