YARA rules for CVE-2018-0802
1 rules · scoped to cve · back to CVE-2018-0802
YARA rules whose family, name, or description matches this cve or its tooling. Use these for binary-pattern hunts.
rule rtf_CVE_2018_0802 {
meta:
author = "Rich Warren"
description = "Attempts to exploit CVE-2018-0802"
reference = "http://www.freebuf.com/vuls/159789.html"
id = "162492a3-d792-5f1c-a143-191c62b54728"
strings:
$equation = { 45 71 75 61 74 69 6F 6E 2E 33 }
$header_and_shellcode = /03010[0,1][0-9a-fA-F]{308,310}2500/ ascii nocase
condition:
uint32be(0) == 0x7B5C7274 // RTF header
and all of them
}