YARA rules for CVE-2015-2545
1 rules · scoped to cve · back to CVE-2015-2545
YARA rules whose family, name, or description matches this cve or its tooling. Use these for binary-pattern hunts.
rule Exp_EPS_CVE20152545 {
meta:
description = "Detects EPS Word Exploit CVE-2015-2545"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "Internal Research - ME"
date = "2017-07-19"
score = 70
id = "9a5f0554-b588-5b82-93df-0fdfba2af2da"
strings:
$s1 = "word/media/image1.eps" ascii
$s2 = "-la;7(la+" ascii
condition:
uint16(0) == 0x4b50 and ( $s1 and #s2 > 20 )
}