SUSP_Password_XLS_Unencrypted

rule SUSP_Password_XLS_Unencrypted {
   meta:
      description = "Detects files named e.g. password.xls, which might contain unportected clear text passwords"
      author = "Arnim Rupp (https://github.com/ruppde)"
      reference = "Internal Research"
      date = "2023-10-04"
      score = 60
      id = "41096ef1-dd02-5956-9053-3d7fb1a5092c"
   condition:
      // match password and the german passwort:
      (
         filename istartswith "passwor" or  /* EN / DE */
         filename istartswith "contrase" or  /* ES */
         filename istartswith "mot de pass" or  /* FR */
         filename istartswith "mot_de_pass" or  /* FR */
         filename istartswith "motdepass" or  /* FR */
         filename istartswith "wachtwoord"  /* NL */
      )
      and (
         // no need to check if an xls is password protected, because it's trivial to break
         (
            filename iendswith ".xls"
            and uint32be(0) == 0xd0cf11e0  // xls
         )
         or
         (
            filename iendswith ".xlsx"
            and uint32be(0) == 0x504b0304  // unencrypted xlsx = pkzip
         )
      )
}