Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_SUSP_DOC_RTF_Externalresource_EMAIL_Jun22

Detects a suspicious pattern in RTF files which downloads external resources as seen in CVE-2022-30190 / Follina exploitation inside e-mail attachment

Suspicious / huntingSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
Christian Burkard
Date
2022-06-01
Modified
2026-05-15
Score / Quality
70 / 85

What this rule detects

Detects a suspicious pattern in RTF files which downloads external resources as seen in CVE-2022-30190 / Follina exploitation inside e-mail attachment

It defines 9 patterns (9 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
susp-doc-rtf-externalresource-email-jun22.yarDetection Rule License 1.1
rule SIGNATURE_BASE_SUSP_DOC_RTF_Externalresource_EMAIL_Jun22 : CVE_2022_30190 FILE
{
	meta:
		description = "Detects a suspicious pattern in RTF files which downloads external resources as seen in CVE-2022-30190 / Follina exploitation inside e-mail attachment"
		author = "Christian Burkard"
		id = "3ddc838c-8520-5572-9652-8cb823f83e27"
		date = "2022-06-01"
		modified = "2026-05-15"
		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_doc_follina.yar#L195-L221"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "73e76bd80f77640c0d8d47ebb7903eb9cc23336fbe653e7d008cae6a0de7c45b"
		score = 70
		quality = 85
		tags = "CVE-2022-30190, FILE"

	strings:
		$sa1 = "PFJlbGF0aW9uc2hpcH" ascii
		$sa2 = "xSZWxhdGlvbnNoaXBz" ascii
		$sa3 = "8UmVsYXRpb25zaGlwc" ascii
		$sb1 = "VGFyZ2V0TW9kZT0iRXh0ZXJuYWwi" ascii
		$sb2 = "RhcmdldE1vZGU9IkV4dGVybmFsI" ascii
		$sb3 = "UYXJnZXRNb2RlPSJFeHRlcm5hbC" ascii
		$sc1 = "Lmh0bWwhI" ascii
		$sc2 = "5odG1sIS" ascii
		$sc3 = "uaHRtbCEi" ascii

	condition:
		filesize < 400KB and 1 of ( $sa* ) and 1 of ( $sb* ) and 1 of ( $sc* )
}

Strings (9 patterns)

IdentifierTypeValueModifiers
$sa1text"PFJlbGF0aW9uc2hpcH"ascii
$sa2text"xSZWxhdGlvbnNoaXBz"ascii
$sa3text"8UmVsYXRpb25zaGlwc"ascii
$sb1text"VGFyZ2V0TW9kZT0iRXh0ZXJuYWwi"ascii
$sb2text"RhcmdldE1vZGU9IkV4dGVybmFsI"ascii
$sb3text"UYXJnZXRNb2RlPSJFeHRlcm5hbC"ascii
$sc1text"Lmh0bWwhI"ascii
$sc2text"5odG1sIS"ascii
$sc3text"uaHRtbCEi"ascii

Condition

filesize < 400KB and 1 of ( $sa* ) and 1 of ( $sb* ) and 1 of ( $sc* )

In plain words (Heuristic)

  • The file must be smaller than 400KB (a cheap guard that skips large files).
  • At least 1 patterns in ( $sa* ) must match.
  • At least 1 patterns in ( $sb* ) must match.
  • At least 1 patterns in ( $sc* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: Christian Burkard

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 3ddc838c-8520-5572-9652-8cb823f83e27

Tags:CVE_2022_30190FILE

Related rules