Browse Rules

Attachment: Office file contains OLE relationship to credential phishing page

Office file OLE relationship link is a credential page, or contains credential phishing language.

Attachment: Malformed OLE file

Attached OLE file (typically a Microsoft Office document) is malformed, possibly to evade traditional scanners and filters.

Attachment with high risk VBA macro (unsolicited)

Potentially malicious attachment containing a VBA macro. Oletools categorizes the macro risk as 'high'.

Attachment: OLE external relationship containing file scheme link to executable filetype

This rule identifies attachments containing file scheme links pointing to executable file types, a common indicator of malware distribution. It applies to various suspicious file extensions and archive formats, aiming to prevent the initiation and execution of malicious software.

Attachment with auto-executing macro (unsolicited)

Attachment from an unsolicited sender contains a macro that will auto-execute when the file is opened. Macros are a common phishing technique used to deploy malware.

Attachment: OLE external relationship containing file scheme link to IP address

This rule identifies attachments containing file scheme links pointing to IP Addresses, a common indicator of malware distribution. It applies to various suspicious file extensions and archive formats, aiming to prevent the initiation and execution of malicious software. The rule negates firing on IP addresses governed by RFC1918 or privately allocated space.

Attachment: RTF with embedded content

RTF files can contain embedded content similar to OLE files (Microsoft Office documents.)

Attachment: Encrypted Microsoft Office file (unsolicited)

Encrypted OLE2 (eg Microsoft Office) attachment from an unsolicited sender. Attachment encryption is a common technique used to bypass malware scanning products. Use if receiving encrypted attachments is not normal behavior in your environment.

Attachment: CVE-2021-40444 - MSHTML Remote Code Execution Vulnerability

Attachment contains an external relationship that attempts to load a remote OLE object, consistent with use in CVE-2021-40444. On September 7, 2021, Microsoft released details about a zero day RCE vulnerability in MSHTML that affects Microsoft Windows. According to Microsoft: "we are aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents. An attacker could craft a malicious ActiveX control to be used by a Microsoft Office docu