Signature Base unknown stable yara

SUSP_VBA_FileSystem_Access [yara]

Detects suspicious VBA that writes to disk and is activated on document open

View Source

Detection Logic

uint16(0) == 0xcfd0 and filesize < 100KB and all of ($s*) and 1 of ($a*)

Field Validations

Loading…

Comments (0)

Loading comments...