SUSP_Password_XLS_Encrypted

rule SUSP_Password_XLS_Encrypted {
   meta:
      description = "Detects files named e.g. password.xlsx, which might contain clear text passwords, but are password protected from MS Office"
      author = "Arnim Rupp (https://github.com/ruppde)"
      reference = "Internal Research"
      date = "2023-10-04"
      score = 50
      id = "d3334923-3396-524d-9111-8ccb754ab99e"
   condition:
      // match password and the german passwort:
      (
         filename istartswith "passwor" or  /* EN / DE */
         filename istartswith "contrase" or  /* ES */
         filename istartswith "mot de pass" or  /* FR */
         filename istartswith "mot_de_pass" or  /* FR */
         filename istartswith "motdepass" or  /* FR */
         filename istartswith "wachtwoord"  /* NL */
      )
      and filename iendswith ".xlsx"
      and uint32be(0) == 0xd0cf11e0  // encrypted xlsx = CDFV2
}