YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_EXPL_XML_Encoded_CVE_2021_40444

Detects possible CVE-2021-40444 with no encoding, HTML/XML entity (and hex notation) encoding, or all 3

ExploitSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: James E.C, Proofpoint
Date: 2021-09-18
Modified: 2021-09-19
Score / Quality: 70 / 85

What this rule detects

Detects possible CVE-2021-40444 with no encoding, HTML/XML entity (and hex notation) encoding, or all 3

It defines 3 patterns (1 text, 0 hex, 2 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

expl-xml-encoded-cve-2021-40444.yarDetection Rule License 1.1

rule SIGNATURE_BASE_EXPL_XML_Encoded_CVE_2021_40444 : CVE_2021_40444 FILE
{
	meta:
		description = "Detects possible CVE-2021-40444 with no encoding, HTML/XML entity (and hex notation) encoding, or all 3"
		author = "James E.C, Proofpoint"
		id = "4bf9ec64-c662-5c8f-9e58-12a7412ef07d"
		date = "2021-09-18"
		modified = "2021-09-19"
		reference = "https://twitter.com/sudosev/status/1439205606129377282"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cve_2021_40444.yar#L44-L61"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "13de9f39b1ad232e704b5e0b5051800fcd844e9f661185ace8287a23e9b3868e"
		hash = "84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69"
		logic_hash = "feaeadd8e7e262f191ea0c2f85377531208262e5ac19d6706703e62cf8b4ec90"
		score = 70
		quality = 85
		tags = "CVE-2021-40444, FILE"

	strings:
		$h1 = "<?xml " ascii wide
		$t_xml_r = /Target[\s]{0,20}=[\s]{0,20}\["']([Mm]|&#(109|77|x6d|x4d);)([Hh]|&#(104|72|x68|x48);)([Tt]|&#(116|84|x74|x54);)([Mm]|&#(109|77|x6d|x4d);)([Ll]|&#(108|76|x6c|x4c);)(:|&#58;|&#x3a)/
		$t_mode_r = /TargetMode[\s]{0,20}=[\s]{0,20}\["']([Ee]|&#(x45|x65|69|101);)([Xx]|&#(x58|x78|88|120);)([Tt]|&#(x74|x54|84|116);)/

	condition:
		filesize < 500KB and $h1 and all of ( $t_* )
}

Strings (3 patterns)

Identifier	Type	Value	Modifiers
$h1	text	"<?xml "	ascii wide
$t_xml_r	regex	/Target[\s]{0,20}=[\s]{0,20}\["']([Mm]\|&#(109\|77\|x6d\|x4d);)([Hh]\|&#(104\|72\|x68\|x48);)([Tt]\|&#(116\|84\|x74\|x54);)([Mm]\|&#(109\|77\|x6d\|x4d);)([Ll]\|&#(108\|76\|x6c\|x4c …
$t_mode_r	regex	/TargetMode[\s]{0,20}=[\s]{0,20}\["']([Ee]\|&#(x45\|x65\|69\|101);)([Xx]\|&#(x58\|x78\|88\|120);)([Tt]\|&#(x74\|x54\|84\|116);)/

Condition

filesize < 500KB and $h1 and all of ( $t_* )

In plain words (Heuristic)

The file must be smaller than 500KB (a cheap guard that skips large files).
All patterns in ( $t_* ) must match.
Pattern $h1 must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://twitter.com/sudosev/status/1439205606129377282

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

13de9f39b1ad232e704b5e0b5051800fcd844e9f661185ace8287a23e9b3868e
84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69

Licence & attribution

Author: James E.C, Proofpoint

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 4bf9ec64-c662-5c8f-9e58-12a7412ef07d

Tags:CVE_2021_40444 FILE

SIGNATURE_BASE_EXPL_MAL_Maldoc_OBFUSCT_MHTML_Sep21_1
ExploitSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-09-18
SIGNATURE_BASE_EXPL_CVE_2021_40444_Document_Rels_XML
ExploitSignature Base (Florian Roth / Nextron)· Jeremy Brown / @alteredbytes· 2021-09-10