EXP_potential_CVE_2017_11882

rule EXP_potential_CVE_2017_11882 {
    meta:
      author = "ReversingLabs"
      reference = "https://www.reversinglabs.com/newsroom/news/reversinglabs-yara-rule-detects-cobalt-strike-payload-exploiting-cve-2017-11882.html"
      id = "199710e0-5094-5940-ad29-f01383d5d8c2"
      modified = "2025-06-03"
    strings:
        $docfilemagic = { D0 CF 11 E0 A1 B1 1A E1 }
        $equation1 = "Equation Native" wide ascii
        $equation2 = "Microsoft Equation 3.0" wide ascii
        $mshta = "mshta"
        $http  = "http://"
        $https = "https://"
        $cmd   = "cmd" fullword
        $pwsh  = "powershell"
        $exe   = ".exe"
        $address = { 12 0C 43 00 }

        $fp1 = "Tested with chamber evacuated to 1E-8 Torr on turbo pump" wide
        $fp2 = "d(3z2-r2) to d(x2-y2) is not experimentally identified yet in cuprates" wide
        $fp3 = "Preliminary results of MD simulation of Oxygen cluster infusion into Nb" wide
        $fp4 = "The Mixing is linked to the coefficients p and q" ascii
    condition:
        uint16(0) == 0xcfd0 and $docfilemagic at 0 and
        any of ($mshta, $http, $https, $cmd, $pwsh, $exe) and any of ($equation1, $equation2) and $address
        and not 1 of ($fp*)
}