Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_EXPL_CVE_2021_40444_Document_Rels_XML

Detects indicators found in weaponized documents that exploit CVE-2021-40444

ExploitSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
Jeremy Brown / @alteredbytes
Date
2021-09-10
Modified
2023-12-05
Score / Quality
75 / 85

What this rule detects

Detects indicators found in weaponized documents that exploit CVE-2021-40444

It defines 5 patterns (5 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
expl-cve-2021-40444-document-rels-xml.yarDetection Rule License 1.1
rule SIGNATURE_BASE_EXPL_CVE_2021_40444_Document_Rels_XML : CVE_2021_40444 FILE
{
	meta:
		description = "Detects indicators found in weaponized documents that exploit CVE-2021-40444"
		author = "Jeremy Brown / @alteredbytes"
		id = "812bb68e-71ea-5a9a-8d39-ab99fdaa6c58"
		date = "2021-09-10"
		modified = "2023-12-05"
		reference = "https://twitter.com/AlteredBytes/status/1435811407249952772"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cve_2021_40444.yar#L6-L25"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "b05c3b33c3cab2c9109d808ed197758bc987f07beee77e1f61094715e0c1a1e7"
		score = 75
		quality = 85
		tags = "CVE-2021-40444, FILE"

	strings:
		$b1 = "/relationships/oleObject" ascii
		$b2 = "/relationships/attachedTemplate" ascii
		$c1 = "Target=\"mhtml:http" nocase
		$c2 = "!x-usc:http" nocase
		$c3 = "TargetMode=\"External\"" nocase

	condition:
		uint32( 0 ) == 0x6D783F3C and filesize < 10KB and 1 of ( $b* ) and all of ( $c* )
}

Strings (5 patterns)

IdentifierTypeValueModifiers
$b1text"/relationships/oleObject"ascii
$b2text"/relationships/attachedTemplate"ascii
$c1text"Target=\"mhtml:http"nocase
$c2text"!x-usc:http"nocase
$c3text"TargetMode=\"External\""nocase

Condition

uint32( 0 ) == 0x6D783F3C and filesize < 10KB and 1 of ( $b* ) and all of ( $c* )

In plain words (Heuristic)

  • The file must be smaller than 10KB (a cheap guard that skips large files).
  • All patterns in ( $c* ) must match.
  • At least 1 patterns in ( $b* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: Jeremy Brown / @alteredbytes

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 812bb68e-71ea-5a9a-8d39-ab99fdaa6c58

Tags:CVE_2021_40444FILE

Related rules