shellcode_blob_metadata_ren

YARA detection rule by Glenn Edwards (@hiddenillusion) · GPL-2.0

When there's a large Base64 blob inserted into metadata fields it often indicates shellcode to later be decoded

rule shellcode_blob_metadata_ren: PDF raw {
  meta:
    author      = "Glenn Edwards (@hiddenillusion)"
    version     = "0.1"
    description = "When there's a large Base64 blob inserted into metadata fields it often indicates shellcode to later be decoded"
    weight      = 4

  strings:
    $magic = "%PDF"

    $reg_keyword  = /\/Keywords.?\(([a-zA-Z0-9]{200,})/      $reg_author   = /\/Author.?\(([a-zA-Z0-9]{200,})/
    $reg_title    = /\/Title.?\(([a-zA-Z0-9]{200,})/
    $reg_producer = /\/Producer.?\(([a-zA-Z0-9]{200,})/
    $reg_creator  = /\/Creator.?\(([a-zA-Z0-9]{300,})/
    $reg_create   = /\/CreationDate.?\(([a-zA-Z0-9]{200,})/

  condition:
    $magic in (0..1024) and 1 of ($reg*)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

a6f034d2-f73e-4f68-800f-42e31c4152e3

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion