Cobaltgang_PDF_Metadata_Rev_A

Description

Find documents saved from the same potential Cobalt Gang PDF template

Query · yara

strings:
      $ = "<xmpMM:DocumentID>uuid:31ac3688-619c-4fd4-8e3f-e59d0354a338" ascii wide
   condition:
      any of them
Raw source Cobaltgang_PDF_Metadata_Rev_A · YARA
Esc
Published by Neo23x0/signature-base ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
rule Cobaltgang_PDF_Metadata_Rev_A {
   meta:
      description = "Find documents saved from the same potential Cobalt Gang PDF template"
      author = "Palo Alto Networks Unit 42"
      date = "2018-10-25"
      reference = "https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"
      id = "bcf5bf6e-c786-5f78-bf58-e0631a17e62e"
   strings:
      $ = "<xmpMM:DocumentID>uuid:31ac3688-619c-4fd4-8e3f-e59d0354a338" ascii wide
   condition:
      any of them
}

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.