RTF_Memory_Corruption_Vulnerability.yar

rule RTF_Memory_Corruption_Vulnerability
{
    meta:
        author         = "InQuest Labs"
        description    = "This signature detects a specially crafted RTF file that is designed to trigger a memory corruption vulnerability in the RTF parsing code that would allow an attacker to execute arbitrary code. The successful exploitation of this vulnerability gains the same user rights as the current user."
        created_date   = "2022-03-15"
        updated_date   = "2022-03-15"
        blog_reference = "http://technet.microsoft.com/en-us/security/advisory/2953095"
        labs_reference = "N/A"
        labs_pivot     = "N/A"
        samples        = "a5d921242a81b65d111fe4009d62c6166f7b29762e7a037ee790bf3ee5320da4"

	strings:
			
		$badHdr = "{\\rt{"
		$ocxTag = "\\objocx\\"
		$mscomctl = "MSComctlLib."
		$rop = "?\\u-554"
	condition:
			
		$badHdr and $ocxTag and $mscomctl and #rop>8

}