YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_SUSP_Onenote_Embedded_Filedatastoreobject_Type_Jan23_2

Detects suspicious embedded file types in OneNote files

Suspicious / huntingSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Florian Roth (Nextron Systems)
Date: 2023-01-27
Modified: 2023-12-05
Score / Quality: 65 / 85

What this rule detects

Detects suspicious embedded file types in OneNote files

It defines 2 patterns (1 text, 1 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

susp-onenote-embedded-filedatastoreobject-type-jan23-2.yarDetection Rule License 1.1

rule SIGNATURE_BASE_SUSP_Onenote_Embedded_Filedatastoreobject_Type_Jan23_2 : FILE
{
	meta:
		description = "Detects suspicious embedded file types in OneNote files"
		author = "Florian Roth (Nextron Systems)"
		id = "0664d202-ab4c-57b6-91ee-ea21ac08909e"
		date = "2023-01-27"
		modified = "2023-12-05"
		reference = "https://blog.didierstevens.com/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_onenote_phish.yar#L108-L125"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "bc07598570b6d4ebc5d14cedfed146c1ad309b8890bc0b9ee5f9ad645c1352e2"
		score = 65
		quality = 85
		tags = "FILE"

	strings:
		$a1 = { 00 e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac }
		$s1 = "<HTA:APPLICATION "

	condition:
		filesize < 5MB and $a1 and 1 of ( $s* )
}

Strings (2 patterns)

Identifier	Type	Value	Modifiers
$a1	hex	{ 00 e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac }
$s1	text	"<HTA:APPLICATION "

Condition

filesize < 5MB and $a1 and 1 of ( $s* )

In plain words (Heuristic)

The file must be smaller than 5MB (a cheap guard that skips large files).
At least 1 patterns in ( $s* ) must match.
Pattern $a1 must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://blog.didierstevens.com/

Licence & attribution

Author: Florian Roth (Nextron Systems)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 0664d202-ab4c-57b6-91ee-ea21ac08909e

Tags:FILE

SIGNATURE_BASE_SUSP_MAL_EXFIL_Stealer_Output_Characteristics_Sep22_1
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-09-17
SIGNATURE_BASE_SUSP_Reversed_Base64_Encoded_EXE
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-04-06
SIGNATURE_BASE_SUSP_OBFUSC_Powershell_True_Jun20_1
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-06-27
SIGNATURE_BASE_SUSP_PS1_JAB_Pattern_Jun22_1
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-06-10
SIGNATURE_BASE_SUSP_Base64_Encoded_Exploit_Indicators_Dec21
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-12-10
SIGNATURE_BASE_SUSP_Encoded_Discord_Attachment_Oct21_1
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-10-12
SIGNATURE_BASE_SUSP_IIS_Config_Proxyshell_Artifacts
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-08-25
SIGNATURE_BASE_SUSP_Jdniexploit_Error_Indicators_Dec21_1
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-12-10