Rule History

SID: 2039511 • Source: et/open

Versions (2)

Version DetailsCurrent

Rev: 3 • Nov 29, 2017, 12:00 PM

Message:

ET DELETED Hostile Microsoft Rich Text File (RTF) with corrupted listoverride

Rule:

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Hostile Microsoft Rich Text File (RTF) with corrupted listoverride"; flow:from_server,established; flowbits:set,ETPRO.RTF; content:"|7b 5c 2a 5c|listoverridetable"; content:"|5c|listoverride|5c|"; fast_pattern:only; pcre:"/\x5clistoverride\x5c((?!\x5cls\d{1,4}\s*\}).)+?\x5clistoverride\x5c/s"; reference:cve,2012-0183; classtype:attempted-user; sid:2039511; rev:3; metadata:created_at 2017_11_29, signature_severity Unknown, updated_at 2022_10_24;)

Created:

Nov 29, 2017, 12:00 PM

Updated:

Oct 24, 2022, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

May 30, 2025, 12:04 AM

Filename:

rules/emerging-deleted.rules