SIGNATURE_BASE_Brooxml_Hunting

rule SIGNATURE_BASE_Brooxml_Hunting : HUNTING FILE
{
	meta:
		description = "Detects Microsoft OOXML files with prepended data/manipulated header"
		author = "Proofpoint"
		id = "1ffea1c7-9f97-5bb1-93d7-ce914765416f"
		date = "2024-11-27"
		modified = "2025-06-02"
		reference = "https://x.com/threatinsight/status/1861817946508763480"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_brooxml_dec24.yar#L2-L39"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "8a8d934fe9286c9d1c83a2a0676bb8a5f2501116b96cca32dc27136ecfb9325b"
		score = 70
		quality = 85
		tags = "HUNTING, FILE"
		category = "hunting"

	strings:
		$pk_ooxml_magic = {50 4b 03 04 [22] 13 00 [2] 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c}
		$pk_0102 = {50 4b 01 02}
		$pk_0304 = {50 4b 03 04}
		$pk_0506 = {50 4b 05 06}
		$pk_0708 = {50 4b 07 08}
		$word = "word/"
		$ole = {d0 cf 11 e0}
		$tef = {78 9f 3e 22}

	condition:
		$pk_ooxml_magic in ( 4 .. 16384 ) and $pk_0506 in ( 16384 .. filesize ) and #pk_0506 == 1 and #pk_0102 > 2 and #pk_0304 > 2 and $word and not ( $pk_0102 at 0 ) and not ( $pk_0304 at 0 ) and not ( $pk_0506 at 0 ) and not ( $pk_0708 at 0 ) and not ( $ole at 0 ) and not ( uint16( 0 ) == 0x5a4d ) and not ( $tef at 0 )
}