Rule Info
Name
EXPL_MAL_MalDoc_TemplateInjection_Jun22
Author
Florian Roth, Christian Burkard
Description
Detects Office documents that look as if they were exploiting the Template Injection vulnerability and use an IP address to download and force open the second stage
Score
85
Date
2022-06-03
Minimum Yara
3.5.0
Rule Hash
f37d6460f169a428d9f885986287db85
Tags
['EXPLOIT', 'T1203', 'T1221', 'T1566_001', 'MAL', 'OFFICE']
Required Modules
[]
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
1
Suspicious (< 10 engines)
2
Clean (0 engines)
0
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR