ET DELETED Hostile Microsoft Rich Text File (RTF) with corrupted listoverride

SID: 2039511Rev: 30 viewsHistory

Sourceet/open

CreatedNovember 29, 2017

UpdatedOctober 24, 2022

Classificationattempted-user

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Hostile Microsoft Rich Text File (RTF) with corrupted listoverride"; flow:from_server,established; flowbits:set,ETPRO.RTF; content:"|7b 5c 2a 5c|listoverridetable"; content:"|5c|listoverride|5c|"; fast_pattern:only; pcre:"/\x5clistoverride\x5c((?!\x5cls\d{1,4}\s*\}).)+?\x5clistoverride\x5c/s"; reference:cve,2012-0183; classtype:attempted-user; sid:2039511; rev:3; metadata:created_at 2017_11_29, signature_severity Unknown, updated_at 2022_10_24;)

References

cve

2012-0183

Metadata

created at2017_11_29

signature severityUnknown

updated at2022_10_24

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!