YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_EXPL_Exploit_TLB_Scripts

Detects malicious TLB files which may be delivered via Visual Studio projects

ExploitSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Rich Warren (slightly modified by Florian Roth)
Date: 2021-01-26
Modified: 2023-12-05
Score / Quality: 75 / 85

What this rule detects

Detects malicious TLB files which may be delivered via Visual Studio projects

It defines 5 patterns (5 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

expl-exploit-tlb-scripts.yarDetection Rule License 1.1

rule SIGNATURE_BASE_EXPL_Exploit_TLB_Scripts : FILE
{
	meta:
		description = "Detects malicious TLB files which may be delivered via Visual Studio projects"
		author = "Rich Warren (slightly modified by Florian Roth)"
		id = "5151458e-4c30-50ff-a39e-e5b5b68b87aa"
		date = "2021-01-26"
		modified = "2023-12-05"
		reference = "https://github.com/outflanknl/Presentations/blob/master/Nullcon2020_COM-promise_-_Attacking_Windows_development_environments.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_tlb_scripts.yar#L2-L19"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "39bf626d60a867d054762043f74e86998d6848439655f84be72003c112db9953"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$a = ".sct" ascii nocase
		$b = "script:" ascii nocase
		$c = "scriptlet:" ascii nocase
		$d = "soap:" ascii nocase
		$e = "winmgmts:" ascii nocase

	condition:
		uint32be( 0 ) == 0x4D534654 and filesize < 100KB and any of them
}

Strings (5 patterns)

Identifier	Type	Value	Modifiers
$a	text	".sct"	ascii nocase
$b	text	"script:"	ascii nocase
$c	text	"scriptlet:"	ascii nocase
$d	text	"soap:"	ascii nocase
$e	text	"winmgmts:"	ascii nocase

Condition

uint32be( 0 ) == 0x4D534654 and filesize < 100KB and any of them

In plain words (Heuristic)

The file must be smaller than 100KB (a cheap guard that skips large files).
At least one pattern in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/outflanknl/Presentations/blob/master/Nullcon2020_COM-promise_-_Attacking_Windows_development_environments.pdf

Licence & attribution

Author: Rich Warren (slightly modified by Florian Roth)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 5151458e-4c30-50ff-a39e-e5b5b68b87aa

Tags:FILE